[Git][debian-edu/debian-edu-config][master] 4 commits: Add new daily running script 'debian-edu-apache2-update-allowlist', which...
"Mike Gabriel (@sunweaver)" <[email protected]>
| Newsgroups | gmane.linux.skolelinux.cvs |
|---|---|
| Message-ID | <[email protected]> |
Mike Gabriel pushed to branch master at Debian Edu / debian-edu-config Commits: 57b7fda3 by Daniel Teichmann at 2026-08-17T20:34:11+02:00 Add new daily running script 'debian-edu-apache2-update-allowlist', which updates Apache2 'Host:' allowlist. - - - - - 3aaed7b6 by Daniel Teichmann at 2026-08-17T20:34:11+02:00 Apache2 debian-edu-default.conf: Make Tjener be reachable with custom aliases without 302 redirects. + 10.x.x.x/8 is always allowed. + Allows .crt .dat files to be downloaded without HTTPS. + Supports custom aliases using allowlist map at: '/usr/share/debian-edu-config/apache2_host-allowlist.map'. + Allowlist map will be updated by systemd/cron once a day. + Uses predefined fallback (www.intern). - - - - - 1ca2ebec by Daniel Teichmann at 2026-08-17T20:34:11+02:00 Apache2 debian-edu-default.conf: Convert indentation spaces to tabs (whitespace-only). - - - - - 7edfcae0 by Daniel Teichmann at 2026-08-18T10:02:28+02:00 Rename Apache2 host allowlist to TJENER alias map. Avoid confusion with Debian Edu hosts (devices). The map lists HTTP Host header values that refer to TJENER, not client machines. Also document the timer as 15 minutes after boot, then daily, and add the author email to debian-edu-apache2-update-tjener-aliases. - - - - - 8 changed files: - Makefile - debian/debian-edu-config.cron.daily - + debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.service - + debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.timer - debian/rules - etc/apache2/sites-available/debian-edu-default.conf - + libexec/debian-edu-apache2-update-tjener-aliases - + share/debian-edu-config/apache2_tjener-aliases.map Changes: ===================================== Makefile ===================================== @@ -22,6 +22,7 @@ SPROGS = \ $(NULL) LIBEXECPROGS = \ + debian-edu-apache2-update-tjener-aliases \ debian-edu-cups-queue-autoflush-for-netgroup-hosts \ debian-edu-cups-queue-autoreenable-for-netgroup-hosts \ debian-edu-fsautoresize-for-netgroup-hosts \ @@ -360,6 +361,7 @@ install: install-testsuite $(INSTALL_DATA) sbin/debian-edu-fsautoresizetab $(DESTDIR)/usr/share/debian-edu-config/fsautoresizetab set -e ; for f in \ + share/debian-edu-config/apache2_tjener-aliases.map \ share/debian-edu-config/avahi.smb.service \ share/debian-edu-config/rsyslog-collector \ share/debian-edu-config/rsyslog-filters \ ===================================== debian/debian-edu-config.cron.daily ===================================== @@ -9,3 +9,8 @@ export PATH if [ -x /usr/libexec/debian-edu-config/debian-edu-cups-queue-autoflush-for-netgroup-hosts ]; then exec /usr/libexec/debian-edu-config/debian-edu-cups-queue-autoflush-for-netgroup-hosts fi + +# regularly update Apache2 TJENER alias map if the script is present +if [ -x /usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases ]; then + exec /usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases +fi ===================================== debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.service ===================================== @@ -0,0 +1,6 @@ +[Unit] +Description=Update Apache2 TJENER alias map at /usr/share/debian-edu-config/apache2_tjener-aliases.map + +[Service] +Type=oneshot +ExecStart=/usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases ===================================== debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.timer ===================================== @@ -0,0 +1,9 @@ +[Unit] +Description=Run debian-edu-apache2-update-tjener-aliases.service 15 minutes after boot and then once a day. + +[Timer] +OnBootSec=15min +OnUnitActiveSec=1d + +[Install] +WantedBy=timers.target ===================================== debian/rules ===================================== @@ -23,6 +23,7 @@ override_dh_installsystemd: dh_installsystemd --no-start --name firefox-ldapconf dh_installsystemd --no-start --name debian-edu-fsautoresize dh_installsystemd --no-start --name debian-edu-update-netblock + dh_installsystemd --no-start --name debian-edu-apache2-update-tjener-aliases dh_installsystemd --no-start --name debian-edu-cups-queue-autoflush dh_installsystemd --no-start --name debian-edu-cups-queue-autoreenable ===================================== etc/apache2/sites-available/debian-edu-default.conf ===================================== @@ -1,16 +1,37 @@ <VirtualHost *:80> - ServerName www.intern + ServerName www.intern ServerAdmin [email protected] DocumentRoot /etc/debian-edu/www/ +# ---- <TJENER-alias redirect logic> ---- + UseCanonicalName On + + RewriteEngine On + RewriteMap tjeneralias "txt:/usr/share/debian-edu-config/apache2_tjener-aliases.map" + + # 1. Exclusions: Skip the redirect rules entirely for wpad.dat and Debian-Edu_rootCA.crt + RewriteCond %{REQUEST_URI} \.(?:dat|crt)$ [NC] + RewriteRule ^ - [L] + + # 2. Check if the requested HTTP Host matches Edu IP subnet e.g. 10.x.x.x/8 subnet.. + # NOTE: Single IPs should be part of the TJENER alias map. + # NOTE: .999.999 is technically possible, but harmless. + RewriteCond %1 ^10\.\d{1,3}\.\d{1,3}\.\d{1,3}$ [OR] + + # 3. Path A (The Happy Path): HTTP Host is a known TJENER alias + # We strip the port, check the map. If it matches, redirect preserving the requested name. + RewriteCond %{HTTP_HOST} ^([^:]+) + RewriteCond ${tjeneralias:%1|DENY} ^ALLOW$ [NC] + RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L] + + # 4. Path B (The Fallback): HTTP Host is not a known TJENER alias + # If the request makes it past Rule 3 without triggering the [L] flag, + # it means the name was not in the map. We safely redirect to the static ServerName. + RewriteRule ^(.*)$ https://%{SERVER_NAME}/$1 [R=301,L] +# ---- </TJENER-alias redirect logic> ---- + <Directory /etc/debian-edu/www/ > - RewriteEngine On - RewriteCond %{SERVER_PORT} 80 - # HTTP only: wpad.dat + Debian-Edu_rootCA.crt - RewriteCond %{REQUEST_URI} !\.dat$ - RewriteCond %{REQUEST_URI} !\.crt$ - RewriteRule ^(.*)$ https://%{SERVER_ADDRESS}/$1 [R=301,L] Options Indexes FollowSymLinks MultiViews AllowOverride None Require all granted @@ -32,20 +53,20 @@ CustomLog /var/log/apache2/access.log combined ServerSignature On - Alias /doc/ "/usr/share/doc/" - <Directory "/usr/share/doc/"> - Options Indexes MultiViews FollowSymLinks - AllowOverride None + Alias /doc/ "/usr/share/doc/" + <Directory "/usr/share/doc/"> + Options Indexes MultiViews FollowSymLinks + AllowOverride None Require all denied - Allow from 127.0.0.0/255.0.0.0 ::1/128 - </Directory> + Allow from 127.0.0.0/255.0.0.0 ::1/128 + </Directory> - # add alias for munin, though it should really be handled by munin itself, - # rather than assuming /var/www is the defaultroot.. - Alias /munin "/var/cache/munin/www/" - <Directory /var/cache/munin/www/ > + # add alias for munin, though it should really be handled by munin itself, + # rather than assuming /var/www is the defaultroot.. + Alias /munin "/var/cache/munin/www/" + <Directory /var/cache/munin/www/ > Options Indexes FollowSymLinks MultiViews AllowOverride None Require all granted - </Directory> + </Directory> </VirtualHost> ===================================== libexec/debian-edu-apache2-update-tjener-aliases ===================================== @@ -0,0 +1,219 @@ +#!/bin/bash +# +# Author: Daniel 'dzatoah' Teichmann <[email protected]> +# Date: 2026-03-21 +# License: GNU General Public License v2 or later (GPL-2+) +# + +# ============================================================================= +# Queries LDAP for cNAMERecord entries under the Debian Edu DNS zone and +# smartly merges them into the Apache2 TJENER alias map file. +# +# Usage: /usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases +# ============================================================================= + +set -euo pipefail + +# ----------------------------------------------------------------------------- +# Configuration +# ----------------------------------------------------------------------------- +SCRIPT_PATH="/usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases" +MAP_FILE="/usr/share/debian-edu-config/apache2_tjener-aliases.map" +BACKUP_DIR="/var/backups/apache2-tjener-aliases" +LDAP_BASE="relativeDomainName=tjener,zoneName=intern,cn=tjener,ou=servers,ou=systems,dc=skole,dc=skolelinux,dc=no" +LDAP_OPTS="-x" +LOG_TAG="update-apache2-tjener-aliases" + +# Debian Edu default hostnames (short + .intern variants) — always included +# in the auto-generated block regardless of LDAP output. +DEBIAN_EDU_DEFAULTS=( + "www" "www.intern" + "tjener" "tjener.intern" + "ldap" "ldap.intern" +) + +# ----------------------------------------------------------------------------- +# Helpers +# ----------------------------------------------------------------------------- +log() { logger -t "$LOG_TAG" "$*"; echo "[$(date '+%F %T')] $*"; } +die() { log "ERROR: $*"; exit 1; } + +# ----------------------------------------------------------------------------- +# Sanity checks +# ----------------------------------------------------------------------------- +command -v ldapsearch >/dev/null 2>&1 || die "ldapsearch not found. Install ldap-utils." +[[ -d "$(dirname "$MAP_FILE")" ]] || die "Target directory does not exist: $(dirname "$MAP_FILE")" + +# ----------------------------------------------------------------------------- +# Backup existing map file +# ----------------------------------------------------------------------------- +mkdir -p "$BACKUP_DIR" +if [[ -f "$MAP_FILE" ]]; then + BACKUP_FILE="$BACKUP_DIR/apache2_tjener-aliases.map.$(date '+%Y%m%d_%H%M%S')" + cp "$MAP_FILE" "$BACKUP_FILE" + log "Backed up existing map to: $BACKUP_FILE" + + # Prune backups older than 30 days + find "$BACKUP_DIR" -name "apache2_tjener-aliases.map.*" -mtime +30 -delete +fi + +# ----------------------------------------------------------------------------- +# Parse HAND-EDIT block from existing file (preserve user additions) +# ----------------------------------------------------------------------------- +HAND_EDIT_BLOCK="" +if [[ -f "$MAP_FILE" ]]; then + # Extract everything from the HAND-EDIT marker to end of file + HAND_EDIT_BLOCK=$(awk '/^# ----- IMPORTANT HAND-EDIT ADDITIONS -----/{found=1} found{print}' "$MAP_FILE") +fi + +# If there was no hand-edit block yet, use the default placeholder +if [[ -z "$HAND_EDIT_BLOCK" ]]; then + HAND_EDIT_BLOCK='# ----- IMPORTANT HAND-EDIT ADDITIONS ----- +# If a user browses to the raw IP and it is not here, it will trigger a 302 +# response to a pre-defined server name. +# Add any other IP addresses assigned to Tjeners interfaces: +# 192.168.0.1 ALLOW' +fi + +# ----------------------------------------------------------------------------- +# Query LDAP for cNAMERecord entries +# ----------------------------------------------------------------------------- +log "Querying LDAP for cNAMERecord entries..." +LDAP_OUTPUT=$(ldapsearch $LDAP_OPTS -b "$LDAP_BASE" 2>&1) \ + || die "ldapsearch failed: $LDAP_OUTPUT" + +# Parse relativeDomainName values that have a cNAMERecord attribute. +# Strategy: track the current relativeDomainName per stanza; only emit it +# if a cNAMERecord line is also present in the same stanza. +mapfile -t LDAP_CNAMES < <( + awk ' + /^$/ { if (has_cname && rdn != "" && rdn != "tjener") print rdn; rdn=""; has_cname=0; next } + /^relativeDomainName:/ { rdn=$2 } + /^cNAMERecord:/ { has_cname=1 } + END { if (has_cname && rdn != "" && rdn != "tjener") print rdn } + ' <<< "$LDAP_OUTPUT" | sort -u +) + +log "LDAP returned ${#LDAP_CNAMES[@]} cNAME entries: ${LDAP_CNAMES[*]:-<none>}" + +# ----------------------------------------------------------------------------- +# Build the de-duplicated LDAP-only section +# (skip anything already in the Debian Edu defaults block) +# ----------------------------------------------------------------------------- + +# Build a lookup set of already-covered hostnames (short names only) +declare -A COVERED +for h in "${DEBIAN_EDU_DEFAULTS[@]}"; do + # Strip .intern suffix for comparison + short="${h%.intern}" + COVERED["$short"]=1 +done +# Also mark static entries +for h in localhost tjener; do COVERED["$h"]=1; done + +LDAP_EXTRA_LINES=() +for cname in "${LDAP_CNAMES[@]}"; do + if [[ -z "${COVERED[$cname]+_}" ]]; then + LDAP_EXTRA_LINES+=("$cname") + COVERED["$cname"]=1 + fi +done + +# ----------------------------------------------------------------------------- +# Format helper: pad hostname to column 20 then append ALLOW +# ----------------------------------------------------------------------------- +fmt_allow() { + printf "%-20s ALLOW\n" "$1" +} + +# ----------------------------------------------------------------------------- +# Assemble the new map file in a temp file, then atomically replace +# ----------------------------------------------------------------------------- +TMPFILE=$(mktemp "${MAP_FILE}.tmp.XXXXXX") +trap 'rm -f "$TMPFILE"' EXIT + +{ +# ── Static header ───────────────────────────────────────────────────────────── +cat <<HEADER +# /usr/share/debian-edu-config/apache2_tjener-aliases.map +# Format: <server_alias_or_IP> ALLOW +# +# IMPORTANT: This file will be changed daily by a script using cron/systemd. +# It contains allowed HTTP Host: header values (TJENER aliases +# and IPs), not client machines. +# The script tries to smartly merge existing hand-made entries, +# but you should execute the script manually once to make sure your +# changes are sticking: +# $ ${SCRIPT_PATH} + +# Local loopback devices +$(fmt_allow localhost) +$(fmt_allow "::1") +$(fmt_allow "127.0.0.1") +HEADER + +# ── Auto-generated Debian Edu defaults ──────────────────────────────────────── +cat <<'AUTOGEN_HEADER' + +# --------------------------- +# | Debian Edu defaults | +# --------------------------- +AUTOGEN_HEADER + +echo "# NOTE: 10.x.x.x/8 network is allowed anyway, so next line is redundand." +fmt_allow "10.0.2.2" +fmt_allow "www" +fmt_allow "www.intern" +fmt_allow "tjener" +fmt_allow "tjener.intern" +fmt_allow "ldap" +fmt_allow "ldap.intern" +echo "# ---------------------------" + +# ── LDAP-discovered cNAMEs (not already in defaults) ────────────────────────── +if [[ ${#LDAP_EXTRA_LINES[@]} -gt 0 ]]; then + echo "" + echo "" + echo "# ---------------------------" + echo "# | LDAP-discovered CNAMEs |" + echo "# | (auto-updated daily) |" + echo "# ---------------------------" + echo "# Last updated: $(date '+%Y-%m-%d %H:%M:%S')" + for h in "${LDAP_EXTRA_LINES[@]}"; do + fmt_allow "$h" + # Also emit the .intern variant if not already covered + intern_variant="${h}.intern" + if [[ -z "${COVERED[$intern_variant]+_}" ]]; then + fmt_allow "$intern_variant" + COVERED["$intern_variant"]=1 + fi + done + echo "# ---------------------------" +fi + +# ── Preserved hand-edit block ───────────────────────────────────────────────── +echo "" +echo "" +echo "$HAND_EDIT_BLOCK" + +} > "$TMPFILE" + +# Validate the temp file is non-empty before replacing +[[ -s "$TMPFILE" ]] || die "Generated file is empty — aborting." + +# Atomic replace +mv "$TMPFILE" "$MAP_FILE" +chmod 644 "$MAP_FILE" +log "Successfully updated: $MAP_FILE" + +# ----------------------------------------------------------------------------- +# Reload Apache2 if running (graceful — no dropped connections) +# ----------------------------------------------------------------------------- +if systemctl is-active --quiet apache2; then + log "Reloading Apache2..." + systemctl reload apache2 \ + && log "Apache2 reloaded successfully." \ + || log "WARNING: Apache2 reload failed. Check 'systemctl status apache2'." +else + log "Apache2 is not running — skipping reload." +fi ===================================== share/debian-edu-config/apache2_tjener-aliases.map ===================================== @@ -0,0 +1,44 @@ +# /usr/share/debian-edu-config/apache2_tjener-aliases.map +# Format: <server_alias_or_IP> ALLOW +# +# IMPORTANT: This file will be changed daily by a script using cron/systemd. +# It contains allowed HTTP Host: header values (TJENER aliases +# and IPs), not client machines. +# The script tries to smartly merge existing hand-made entries, +# but you should execute the script manually once to make sure your +# changes are sticking: +# $ /usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases +# +# WARNING: If you can read this and the file modification date is more than 24h +# in the past, then there is an issue with the automatic updating +# script managed by either cron or systemd. This file only contains +# the most basic configuration settings for Debian Edu and needs to be +# updated. +# +# DEV NOTE: If you're are updating this file in the debian-edu-config package +# please be aware that you'll have to adapt the update script too. + +# Local loopback devices +localhost ALLOW +::1 ALLOW +127.0.0.1 ALLOW + +# --------------------------- +# | Debian Edu defaults | +# --------------------------- +# NOTE: 10.x.x.x/8 network is allowed, so next line is redundand. +10.0.2.2 ALLOW +www ALLOW +www.intern ALLOW +tjener ALLOW +tjener.intern ALLOW +ldap ALLOW +ldap.intern ALLOW +# --------------------------- + + +# ----- IMPORTANT HAND-EDIT ADDITIONS ----- +# If a user browses to the raw IP and it is not here, it will trigger a 302 +# response to a pre-defined server name. +# Add any other IP addresses assigned to Tjeners interfaces: +# 172.16.0.51 ALLOW View it on GitLab: https://salsa.debian.org/debian-edu/debian-edu-config/-/compare/0092caec5db4de929a367b5fa8a4c05eec0f2a05...7edfcae0074739a445e5ade74b281fff0fbcdc86 -- View it on GitLab: https://salsa.debian.org/debian-edu/debian-edu-config/-/compare/0092caec5db4de929a367b5fa8a4c05eec0f2a05...7edfcae0074739a445e5ade74b281fff0fbcdc86 You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help _______________________________________________ debian-edu-commits mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-edu-commits