Koozali.org: home of the SME Server

Obsolete Releases => SME 7.x Contribs => Topic started by: R.B. on September 10, 2010, 03:13:52 PM

Title: How to split HTTPS access? (server-manager & password panel)
Post by: R.B. on September 10, 2010, 03:13:52 PM

Hi,
I need to permit access to password panel from Internet (or everywhere) but I need to permit access to server-manager ONLY from LAN.
Is there a way?
(Actually, when HTTPS access is active both of them are available  :(  )

Thanks


System: SME 7.5.1 + password (contrib)

Title: Re: How to split HTTPS access? (server-manager & password panel)
Post by: Daniel B. on September 10, 2010, 03:25:41 PM

I''m using this on my server to let external users manage their password. First, create a custom template here: /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/VirtualHosts/27ManagerProxyPass

And put this content:

Code: [Select]

{
    # vim: ft=perl:

    $haveSSL = (exists ${modSSL}{status} and ${modSSL}{status} eq "enabled") ?  'yes' : 'no';
    $plainTextAccess = ${'httpd-admin'}{PermitPlainTextAccess} || 'no';

    $OUT = '';
    foreach $place ('server-common','user-password')
    {   
        if (($port eq "80") && ($haveSSL eq 'yes') && ($plainTextAccess ne 'yes'))
        {   
            $OUT .= "    RewriteRule ^/$place(/.*|\$)    https://%{HTTP_HOST}/$place\$1 [L,R]\n";
        } else {
            $OUT .= "    ProxyPass /$place http://127.0.0.1:${'httpd-admin'}{TCPPort}/$place\n";
            $OUT .= "    ProxyPassReverse /$place http://127.0.0.1:${'httpd-admin'}{TCPPort}/$place\n";
        }

        $OUT .= "    <Location /$place>\n";
        $OUT .= "        order deny,allow\n";
        $OUT .= "        deny from all\n";
        $OUT .= "        allow from all\n";
        $OUT .= "    </Location>\n";
    }

    if (($port eq "80") && ($haveSSL eq 'yes') && ($plainTextAccess ne 'yes'))
    {
            $OUT .= "    RewriteRule ^/server-manager(/.*|\$)    https://%{HTTP_HOST}/server-manager\$1 [L,R]\n";
    } else {
            $OUT .= "    ProxyPass /server-manager http://127.0.0.1:${'httpd-admin'}{TCPPort}/server-manager\n";
            $OUT .= "    ProxyPassReverse /server-manager http://127.0.0.1:${'httpd-admin'}{TCPPort}/server-manager\n";
    }


    $OUT .=<<"HERE";

    <Location /server-manager>
        order deny,allow
        deny from all
        allow from $localAccess $externalSSLAccess
    </Location>
HERE
}

Then

Code: [Select]

expand-template /etc/httpd/conf/httpd.conf
Check the config file with

Code: [Select]

httpd -t
Which should tell you everything is OK

And restart httpd service with

Code: [Select]

sv t /service/httpd-e-smith

Regards, Daniel

Title: Re: How to split HTTPS access? (server-manager & password panel)
Post by: Stefano on September 10, 2010, 03:26:13 PM

Hi, welcome here

with "password (contrib)" so you mean smeserver-password one?

since I know you are italian, come in italian forum too, thank you

Title: Re: How to split HTTPS access? (server-manager & password panel)
Post by: R.B. on September 10, 2010, 03:43:59 PM

@VIP-ire: Thank you for the solution, I'll try soon...

@Stefano
Grazie per il benvenuto
Ho postato qua perchè nonostante la lingua inglese era il forum dedicato ai contrib (inoltre speravo che rimanendo "internazionale" avrei avuto maggiori possibilità di supporto)
Nel forum italiano è possbile trattare anche i contrib?
Sono ammessi i crosspost tra inglese e italiano? (immagino di no...)
Per "password (contrib)" intendo il "plugin" che permette di avere un pannello di controllo aggiuntivo per le password
In generale si chiamano "smeserver-[nome plugin]" ? (es: smeserver-password ?)

Grazie

Title: Re: How to split HTTPS access? (server-manager & password panel)
Post by: Stefano on September 10, 2010, 03:52:36 PM

Quote from: R.B. on September 10, 2010, 03:43:59 PM

@VIP-ire: Thank you for the solution, I'll try soon...

@Stefano
Grazie per il benvenuto

you are welcome

please don't post here in italian, thank you

Quote

Ho postato qua perchè nonostante la lingua inglese era il forum dedicato ai contrib (inoltre speravo che rimanendo "internazionale" avrei avuto maggiori possibilità di supporto)
Nel forum italiano è possbile trattare anche i contrib?
Sono ammessi i crosspost tra inglese e italiano? (immagino di no...)
Per "password (contrib)" intendo il "plugin" che permette di avere un pannello di controllo aggiuntivo per le password
In generale si chiamano "smeserver-[nome plugin]" ? (es: smeserver-password ?)

Grazie

the answer to most of your questions is "yes".. please come to italian forum, thank you