Koozali.org: home of the SME Server

Obsolete Releases => SME Server 7.x => Topic started by: hoover87 on September 18, 2009, 10:14:26 PM

Title: Disable https for password change page.
Post by: hoover87 on September 18, 2009, 10:14:26 PM

Is there a semi-easy way to disable https for the password change page?

Please spare me the security risk lessons.  I'm fronting the unsecured network with an SSL VPN portal and am trouble-shooting issues with redirects to https intranet pages.

Thanks

Title: Re: Disable https for password change page.
Post by: cactus on September 19, 2009, 09:35:46 AM

Quote from: hoover87 on September 18, 2009, 10:14:26 PM

Is there a semi-easy way to disable https for the password change page?

Sorry still think we need to...

Quote from: hoover87 on September 18, 2009, 10:14:26 PM

Please spare me the security risk lessons.  I'm fronting the unsecured network with an SSL VPN portal and am trouble-shooting issues with redirects to https intranet pages.

... as in this setup your password will travel unencrypted over the line between SSL VPN portal and SME Server.

To go short your solution is in adding a custom template based on /etc/e-smith/httpd/conf/httpd.conf/VirtualHosts/27ManagerProxyPass in the templates-custom tree and modify the copy according to your needs. Information on the template system can be found in the wiki in the SME Server Developers Guide.