Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use SSL by default #122

Merged
merged 11 commits into from
Apr 9, 2018
Merged

Use SSL by default #122

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
ebe2b65
Updated nginx configs; added clientSetup4RMT script
ikapelyukhin Mar 27, 2018
2d4aaf5
Fix minor issues with packaging
ikapelyukhin Mar 28, 2018
e064b5f
Use TLSv1.2 by default
ikapelyukhin Mar 29, 2018
d6159a6
Bump up the version and add changes file section
ikapelyukhin Apr 3, 2018
7825817
Make systemd RMT unit depend on nginx
ikapelyukhin Apr 3, 2018
4143376
Rename registration-server.pem
ikapelyukhin Apr 4, 2018
b59df6f
Merge branch 'master' into ssl_packaging_changes
digitaltom Apr 6, 2018
f963a91
remove namespace references
digitaltom Apr 6, 2018
af0f5c8
Remove unnecessary code
ikapelyukhin Apr 9, 2018
6b12dc1
Merge branch 'master' into ssl_packaging_changes
ikapelyukhin Apr 9, 2018
f67cb25
Disable autoindex for plain HTTP
ikapelyukhin Apr 9, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
11 changes: 8 additions & 3 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
NAME = rmt-server
VERSION = 0.0.4
VERSION = 0.0.5

all:
@:
Expand All @@ -25,16 +25,21 @@ dist: clean man
@cp -r Gemfile $(NAME)-$(VERSION)/
@cp -r Gemfile.lock $(NAME)-$(VERSION)/
@cp -r lib $(NAME)-$(VERSION)/

@mkdir $(NAME)-$(VERSION)/log
@cp -r log/.keep $(NAME)-$(VERSION)/log
@cp -r Rakefile $(NAME)-$(VERSION)/
@cp -r README.md $(NAME)-$(VERSION)/
@mkdir $(NAME)-$(VERSION)/ssl
@cp -r ssl/.keep $(NAME)-$(VERSION)/ssl
@mkdir $(NAME)-$(VERSION)/tmp
@cp -r tmp/.keep $(NAME)-$(VERSION)/tmp

@cp -r Rakefile $(NAME)-$(VERSION)/
@cp -r README.md $(NAME)-$(VERSION)/
@cp -r .bundle $(NAME)-$(VERSION)/
@cp -r locale $(NAME)-$(VERSION)/
@mkdir $(NAME)-$(VERSION)/vendor
@mkdir -p $(NAME)-$(VERSION)/public/repo/
@cp -r public/tools $(NAME)-$(VERSION)/public/

@rm -rf $(NAME)-$(VERSION)/config/rmt.yml
@rm -rf $(NAME)-$(VERSION)/config/rmt.local.yml
Expand Down
2 changes: 1 addition & 1 deletion lib/rmt.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
module RMT
VERSION ||= '0.0.4'.freeze
VERSION ||= '0.0.5'.freeze

DEFAULT_USER = '_rmt'.freeze
DEFAULT_GROUP = 'nginx'.freeze
Expand Down
15 changes: 15 additions & 0 deletions package/nginx-http.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
server {
listen 80 default;
server_name rmt;
access_log /var/log/nginx/rmt_http_access.log;
error_log /var/log/nginx/rmt_http_error.log;
root /usr/share/rmt/public;

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not white list the tools/clientSetup4RMT.sh only and redirect everything else to https?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is the clientSetup4RMT.sh the only usecase for plain http, or should the repository data also be available over http?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@felixsch What do you mean specifically? It doesn't do a redirect at the moment, but otherwise that's what it does.

@digitaltom That's up for discussion. SMT does allow access to RPMs over plain HTTP. If you want to learn how many users do that instead of using SUSEConnect -- we could disable access over HTTP and see how many users complain 😬

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@digitaltom actually asked the question behind my statement. If no access to HTTP should be allowed, why not redirect to HTTPS everything except the clientSetup4RMT.sh.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@kalabiyau Do you have any thoughts on this? Should the RPMs be accessible over plain HTTP?
SMT serves RPMs over HTTP, at the moment RMT does the same -- only the API is restricted to HTTPS.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ikapelyukhin as you described to me that atm we have:

registration would by default offer https:// urls
and plain access is allowed to the content via http://

I believe it is a sane setup.

location / {
autoindex off;
}

location /repo {
autoindex on;
}
}
42 changes: 42 additions & 0 deletions package/nginx-https.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
upstream rmt {
server localhost:4224;
}

server {
listen 443 ssl;
server_name rmt;

access_log /var/log/nginx/rmt_https_access.log;
error_log /var/log/nginx/rmt_https_error.log;
root /usr/share/rmt/public;

ssl_certificate /usr/share/rmt/ssl/rmt-server.crt;
ssl_certificate_key /usr/share/rmt/ssl/rmt-server.key;
ssl_protocols TLSv1.2 TLSv1.3;

location / {
try_files $uri/index.html $uri.html $uri @rmt_app;
autoindex off;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why is it off on https?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually, I guess it should be off for plain HTTP version. It should list only repos and maybe tools directories.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK, I've disabled autoindex for plain HTTP instead.

}

location /repo {
autoindex on;
}

location @rmt_app {
proxy_pass http://rmt;
proxy_redirect off;
proxy_read_timeout 600;

proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Ssl on;
proxy_set_header X-Real-IP $remote_addr;
}

# An alias to RMT CA certificate, so that it can be downloaded to client machines.
location /rmt.crt {
alias /usr/share/rmt/ssl/rmt-ca.crt;
}
}
8 changes: 8 additions & 0 deletions package/rmt-server.changes
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,11 @@
-------------------------------------------------------------------
Mon Apr 9 09:58:02 UTC 2018 - ikapelyukhin@suse.com

- version 0.0.5
- Allow access to the API only via HTTPS, add directories to store SSL
keys & certificates, add clientSetup4RMT.sh script
https://github.com/SUSE/rmt/pull/122

-------------------------------------------------------------------
Fri Apr 6 13:45:21 UTC 2018 - hschmidt@suse.com

Expand Down
29 changes: 0 additions & 29 deletions package/rmt-server.conf
View file
Open in desktop

This file was deleted.

17 changes: 11 additions & 6 deletions package/rmt-server.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@
%define rmt_group nginx

Name: rmt-server
Version: 0.0.4
Version: 0.0.5
Release: 0
Summary: Repository mirroring tool and registration proxy for SCC
License: GPL-2.0+
Expand All @@ -40,7 +40,7 @@ Source0: %{name}-%{version}.tar.bz2
Source1: rmt-server-rpmlintrc
Source2: rmt.conf
Source3: rmt.8.gz
Source4: rmt-server.conf
Source4: nginx-http.conf
Source5: rmt-server-mirror.service
Source6: rmt-server-mirror.timer
Source7: rmt-server-sync.service
Expand All @@ -50,6 +50,7 @@ Source10: rmt.target
Source11: rmt-migration.service
Source12: rmt-server-sync-sles12.timer
Source13: rmt-server-mirror-sles12.timer
Source14: nginx-https.conf

Patch0: use-ruby-2.5-in-rmt-cli.patch
Patch1: use-ruby-2.5-in-rails.patch
Expand Down Expand Up @@ -104,12 +105,14 @@ mkdir -p %{buildroot}%{lib_dir}
mkdir -p %{buildroot}%{app_dir}

mv tmp %{buildroot}%{data_dir}
mv public %{buildroot}%{data_dir}
mkdir %{buildroot}%{data_dir}/public
mv public/repo %{buildroot}%{data_dir}/public/
mv vendor %{buildroot}%{lib_dir}
mv ssl %{buildroot}%{app_dir}

cp -ar . %{buildroot}%{app_dir}
ln -s %{data_dir}/tmp %{buildroot}%{app_dir}/tmp
ln -s %{data_dir}/public %{buildroot}%{app_dir}/public
ln -s %{data_dir}/public/repo %{buildroot}%{app_dir}/public/repo
mkdir -p %{buildroot}%{_bindir}
ln -s %{app_dir}/bin/rmt-cli %{buildroot}%{_bindir}
install -D -m 644 %_sourcedir/rmt.8.gz %{buildroot}%_mandir/man8/rmt.8.gz
Expand Down Expand Up @@ -140,7 +143,8 @@ mkdir -p %{buildroot}%{_sysconfdir}
mv %{_builddir}/rmt.conf %{buildroot}%{_sysconfdir}/rmt.conf

# nginx
install -D -m 644 %{SOURCE4} %{buildroot}%{_sysconfdir}/nginx/vhosts.d/rmt-server.conf
install -D -m 644 %{SOURCE4} %{buildroot}%{_sysconfdir}/nginx/vhosts.d/rmt-server-http.conf
install -D -m 644 %{SOURCE14} %{buildroot}%{_sysconfdir}/nginx/vhosts.d/rmt-server-https.conf

sed -i -e '/BUNDLE_PATH: .*/cBUNDLE_PATH: "\/usr\/lib64\/rmt\/vendor\/bundle\/"' \
-e 's/^BUNDLE_JOBS: .*/BUNDLE_JOBS: "1"/' \
Expand Down Expand Up @@ -179,7 +183,8 @@ find %{buildroot}%{lib_dir}/vendor/bundle/ruby/*/gems/yard*/ -type f -exec chmod
%attr(-,%{rmt_user},%{rmt_group}) %{app_dir}
%attr(-,%{rmt_user},%{rmt_group}) %{data_dir}
%config(noreplace) %{_sysconfdir}/rmt.conf
%config(noreplace) %{_sysconfdir}/nginx/vhosts.d/rmt-server.conf
%config(noreplace) %{_sysconfdir}/nginx/vhosts.d/rmt-server-http.conf
%config(noreplace) %{_sysconfdir}/nginx/vhosts.d/rmt-server-https.conf
%doc %{_mandir}/man8/rmt.8.gz
%{_sysconfdir}/nginx
%{_sysconfdir}/nginx/vhosts.d
Expand Down
1 change: 1 addition & 0 deletions package/rmt.service
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
Description=RMT API server
Requires=mysql.service
Requires=rmt-migration.service
Requires=nginx.service
After=rmt-migration.service

[Service]
Expand Down