svn commit: r1936140 - spamassassin/trunk/build/automc
[email protected] Tue, 14 Jul 2026 17:31:50 -0000
| Newsgroups | gmane.mail.spam.spamassassin.cvs |
|---|---|
| Message-ID | <178405031053.409519.14268584265795090267@svn03-he-fi> |
Author: billcole
Date: Tue Jul 14 17:31:50 2026
New Revision: 1936140
Log:
sync online changes
Modified:
spamassassin/trunk/build/automc/apache2-le-ssl.conf
Modified: spamassassin/trunk/build/automc/apache2-le-ssl.conf
==============================================================================
--- spamassassin/trunk/build/automc/apache2-le-ssl.conf Tue Jul 14 16:33:43 2026 (r1936139)
+++ spamassassin/trunk/build/automc/apache2-le-ssl.conf Tue Jul 14 17:31:50 2026 (r1936140)
@@ -11,7 +11,7 @@ SSLStaplingCache "shmcb:/var/log/apache2
ServerName ruleqa.spamassassin.org
ServerAlias ruleqa-trunk.spamassassin.org
ServerAlias ruleqa-stable.spamassassin.org
-
+
ErrorLog ${APACHE_LOG_DIR}/ruleqa.spamassassin.org-error.log
CustomLog ${APACHE_LOG_DIR}/ruleqa.spamassassin.org-access.log combined
@@ -42,17 +42,17 @@ SSLStaplingCache "shmcb:/var/log/apache2
SSLCertificateKeyFile /etc/letsencrypt/live/spamassassin.org/privkey.pem
# https://ssl-config.mozilla.org/#server=apache&version=2.4.41&config=intermediate&openssl=1.1.1f&hsts=false&guideline=5.4
# intermediate configuration
- #SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
- #SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
- #SSLHonorCipherOrder off
- #SSLSessionTickets off
- #SSLUseStapling On
+ #SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
+ #SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
+ #SSLHonorCipherOrder off
+ #SSLSessionTickets off
+ #SSLUseStapling On
# old configuration
- SSLProtocol all -SSLv3
- SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA
+ SSLProtocol all -SSLv3
+ SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA
SSLHonorCipherOrder on
SSLSessionTickets off
- SSLUseStapling On
+ SSLUseStapling On
<Directory /var/www/ruleqa.spamassassin.org>
Options Indexes FollowSymLinks ExecCGI
@@ -70,8 +70,7 @@ SSLStaplingCache "shmcb:/var/log/apache2
RewriteEngine On
# debugging:
- # RewriteLogLevel 9
- # RewriteLog /var/apache2/logs/rewrite_log
+ #LogLevel alert rewrite:trace3
# "%2F" is used to grep rule subsets, allow it
AllowEncodedSlashes On
@@ -83,9 +82,20 @@ SSLStaplingCache "shmcb:/var/log/apache2
# Disallow some pesky robots
RewriteCond %{REMOTE_ADDR} !^(?:127\.0\.0\.1|10\..*)$
RewriteCond %{REQUEST_URI} !=/robots.txt
- RewriteCond %{HTTP_USER_AGENT} "(?:Bot|Spider|Crawl)" [NC,OR]
+ # RewriteCond %{HTTP_USER_AGENT} "(?:Bot|Spider|Crawl)" [NC,OR]
+ RewriteCond %{HTTP_USER_AGENT} "^.*(yacybot|ClaudeBot|Yandex|Bytespider|OPPO|ChatGLM|meta-externalagent).*$" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "(?:Chrome/4|Firefox/4)"
- RewriteRule ^ - [F]
+ RewriteRule . - [R=403,L]
+ # RewriteRule ^ - [F]
+
+ # Require a CORRECT local referer for costly tasks
+ RewriteCond "%{HTTP_REFERER}" "^$" [OR]
+ RewriteCond "%{HTTP_REFERER}" "sa-vm.apache.org" [NC,OR]
+ RewriteCond "%{HTTP_REFERER}" "bbmass.spamassassin.org" [NC,OR]
+ RewriteCond "%{HTTP_REFERER}" "rsync.spamassassin.org" [NC,OR]
+ RewriteCond "%{HTTP_REFERER}" "buildbot.spamassassin.org" [NC]
+ RewriteCond "%{QUERY_STRING}" "(detail|mclog|mtime)" [NC]
+ RewriteRule ^/20.*$ / [F,NC,L]
# Serve cached index for all except ourselves (/usr/local/bin/updateRuleqaIndex.sh)
RewriteCond %{REQUEST_URI} ^/$
@@ -139,17 +149,17 @@ SSLStaplingCache "shmcb:/var/log/apache2
SSLCertificateKeyFile /etc/letsencrypt/live/spamassassin.org/privkey.pem
# https://ssl-config.mozilla.org/#server=apache&version=2.4.41&config=intermediate&openssl=1.1.1f&hsts=false&guideline=5.4
# intermediate configuration
- #SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
- #SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
- #SSLHonorCipherOrder off
- #SSLSessionTickets off
- #SSLUseStapling On
+ #SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
+ #SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
+ #SSLHonorCipherOrder off
+ #SSLSessionTickets off
+ #SSLUseStapling On
# old configuration
- SSLProtocol all -SSLv3
- SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA
+ SSLProtocol all -SSLv3
+ SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA
SSLHonorCipherOrder on
SSLSessionTickets off
- SSLUseStapling On
+ SSLUseStapling On
</VirtualHost>
@@ -181,17 +191,17 @@ SSLStaplingCache "shmcb:/var/log/apache2
SSLCertificateKeyFile /etc/letsencrypt/live/spamassassin.org/privkey.pem
# https://ssl-config.mozilla.org/#server=apache&version=2.4.41&config=intermediate&openssl=1.1.1f&hsts=false&guideline=5.4
# intermediate configuration
- #SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
- #SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
- #SSLHonorCipherOrder off
- #SSLSessionTickets off
- #SSLUseStapling On
+ #SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
+ #SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
+ #SSLHonorCipherOrder off
+ #SSLSessionTickets off
+ #SSLUseStapling On
# old configuration
- SSLProtocol all -SSLv3
- SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA
+ SSLProtocol all -SSLv3
+ SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA
SSLHonorCipherOrder on
SSLSessionTickets off
- SSLUseStapling On
+ SSLUseStapling On
</VirtualHost>