nextcloud
/
vm
зеркало из
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность
2 358 коммитов 8 Ветки 79 Теги 70 MiB
Граф коммитов

178 Коммитов

Автор SHA1 Сообщение Дата
Daniel Hansson 756f8bcaf6
update info text (#2143) 2021-11-20 11:32:23 +01:00
Daniel Hansson 519d2f8042
Alloverride None, and include .htaccess (#2110) 
Signed-off-by: enoch85 <github@hanssonit.se>
 2021-10-07 22:23:30 +02:00
Daniel Hansson 6264139d54
change wording 2021-07-31 10:58:07 +02:00
Daniel Hansson 1fe2467c77
change to ECDSA keys for certbot (#2069) 2021-07-30 20:13:25 +02:00
szaimen 0ce7f6a4df
fix minor detail (#2036) 
Signed-off-by: szaimen <szaimen@e.mail.de>
 2021-06-26 11:39:47 +02:00
Daniel Hansson 404ac01b0a
cleanup code (#1975) 
* cleanup code

* fix LE

* Update security.sh

* remove SC diasble

* really needed upgrade for the security script
 2021-05-21 11:36:58 +02:00
Daniel Hansson e2525257c4
merge on release day (#1966) 2021-05-20 11:39:10 +02:00
Daniel Hansson d6d9d06f67
put if argument in the rigth place (#1964) 2021-05-18 12:37:46 +02:00
Daniel Hansson 1fd5014edc
fix last bug 2021-05-18 01:07:09 +02:00
Daniel Hansson 2e7bbb3210
don't check for nono ports as it's not in the released lib 2021-05-18 00:28:49 +02:00
Daniel Hansson 9bd9c3ccad
add test-config for regular port as well 2021-05-18 00:12:22 +02:00
Daniel Hansson 7861d2d607
default to no for real this time 2021-05-17 23:48:51 +02:00
Daniel Hansson 3a2fdbde4f
default to "no" 2021-05-17 23:29:49 +02:00
Daniel Hansson 4b637df3e7
improve desec port selection (#1962) 2021-05-17 23:16:08 +02:00
Daniel Hansson db51f18c10
escape * in sed 2021-05-17 21:40:59 +02:00
Daniel Hansson 80f2ffd571
fix bug 2021-05-17 21:21:03 +02:00
Daniel Hansson 83f69ef747
choose port with deSEC (#1960) 2021-05-17 20:53:42 +02:00
szaimen c455010ba1
fix APACHE_LOG_DIR (#1932) 
Signed-off-by: szaimen <szaimen@e.mail.de>
 2021-04-25 15:23:05 +02:00
Daniel Hansson 1dfa9e6fd7
Revert "reintroduce line breaks to specific command in activate-tls (#1922)" (#1930) 
This reverts commit 5430d1ba48.
 2021-04-22 23:19:45 +02:00
szaimen 5430d1ba48
reintroduce line breaks to specific command in activate-tls (#1922) 
Signed-off-by: szaimen <szaimen@e.mail.de>

Co-authored-by: Daniel Hansson <github@hanssonit.se>
 2021-04-22 23:12:03 +02:00
Daniel Hansson caa3b163b8
catch error on regular run (#1921) 2021-04-16 14:47:16 +02:00
Daniel Hansson 2e8c2b5763
Add DNS updates with deSEC (#1920) 2021-04-11 17:36:29 +02:00
szaimen c8c6da8796
improve letsencryptrenew crontab (#1905) 
Signed-off-by: szaimen <szaimen@e.mail.de>
 2021-03-27 18:09:34 +01:00
Daniel Hansson 8083698866
deSEC magic (#1725) 
Co-authored-by: Peter Thomassen <4242683+peterthomassen@users.noreply.github.com>
Co-authored-by: szaimen <szaimen@e.mail.de>
 2021-03-10 12:12:58 +01:00
Daniel Hansson b153e73d89
update strict transport security (#1833) 2021-02-20 01:21:20 +01:00
szaimen 01d2cd2182
avoid double crontabs (#1808) 
Signed-off-by: szaimen <szaimen@e.mail.de>
 2021-02-10 10:59:26 +01:00
Daniel Hansson 6b1c7fee14
happy new year! (#1749) 
* happy new year!

Signed-off-by: enoch85 <github@hanssonit.se>

* fix some comments and restore geoip database files

Signed-off-by: szaimen <szaimen@e.mail.de>

Co-authored-by: szaimen <szaimen@e.mail.de>
 2021-01-01 15:34:25 +01:00
Ted B e65ff4aaba
Fix spelling in VM (#1706) 
Signed-off-by: Lantrix <lantrix@pobox.com>
 2020-12-03 21:24:33 +01:00
Daniel Hansson 73936ddd43
don't use function without lib 2020-11-30 20:45:08 +01:00
Daniel Hansson 383a4e1c3e
put default SC rules in a single file (#1667) 
Signed-off-by: enoch85 <github@hanssonit.se>
 2020-11-12 21:39:53 +01:00
Daniel Hansson 43500670e1
do not exit 2020-11-06 17:16:32 +01:00
Daniel Hansson cbc2c80217
Use start_if_stopped instead of just service start (#1608) 
Signed-off-by: enoch85 <github@hanssonit.se>
 2020-10-19 20:46:01 +02:00
Daniel Hansson a75e64897e
TLS1.3 and improvements (#1578) 
Signed-off-by: enoch85 <github@hanssonit.se>
 2020-10-16 23:22:34 +02:00
szaimen f28af0807a
make all scripts much more readable (#1493) 
Co-authored-by: Daniel Hansson <github@hanssonit.se>
 2020-10-14 11:16:35 +02:00
Daniel Hansson 577601d63a
old le script doesn't have fetch_lib 2020-10-04 10:51:13 +02:00
Daniel Hansson f251b03549
go live with fetch lib (#1520) 
Signed-off-by: enoch85 <github@hanssonit.se>
 2020-10-03 21:09:15 +02:00
Daniel Hansson 5ca0ba8387
chaneg to real link 2020-09-18 12:16:00 +02:00
Daniel Hansson a116de1aac
another typo 2020-09-18 12:13:27 +02:00
Daniel Hansson 3f9c7cd3cc
typo 2020-09-18 12:10:14 +02:00
Daniel Hansson 6aba7b7935
create open_port function to automatically open ports over upnp (#1469) 
Co-authored-by: szaimen <szaimen@e.mail.de>
 2020-09-18 12:04:31 +02:00
Daniel Hansson 9d41d1b274
Revert "create open_port function to automatically open ports over upnp (#1464)" (#1468) 
This reverts commit 567c2759c9.

I commited the wrong PR!
 2020-09-17 11:23:40 +02:00
szaimen 567c2759c9
create open_port function to automatically open ports over upnp (#1464) 
Co-authored-by: Daniel Hansson <github@hanssonit.se>
 2020-09-17 11:22:14 +02:00
szaimen eda50026fd
create input_box_flow (#1449) 
Co-authored-by: Daniel Hansson <github@hanssonit.se>
 2020-09-13 19:18:02 +02:00
szaimen 9adb4e422a
some small fixes and enhancements (#1440) 2020-09-10 21:31:43 +02:00
Daniel Hansson 34002c7589
only allow tls1.2 
```
Configuration
Protocols
TLS 1.3 	No
TLS 1.2 	Yes
TLS 1.1 	No
TLS 1.0 	No
SSL 3 	No
SSL 2 	No


Cipher Suites
# TLS 1.2 (suites in server-preferred order)
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)   ECDH x25519 (eq. 3072 bits RSA)   FS 	128
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)   ECDH x25519 (eq. 3072 bits RSA)   FS 	256
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8)   ECDH x25519 (eq. 3072 bits RSA)   FS 	256
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x9e)   DH 4096 bits   FS 	128
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x9f)   DH 4096 bits   FS 	256


Handshake Simulation
Android 4.4.2 	RSA 4096 (SHA256)   	TLS 1.2 	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
Android 5.0.0 	RSA 4096 (SHA256)   	TLS 1.2 	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
Android 6.0 	RSA 4096 (SHA256)   	TLS 1.2 > http/1.1   	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
Android 7.0 	RSA 4096 (SHA256)   	TLS 1.2 > h2   	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH x25519  FS
Android 8.0 	RSA 4096 (SHA256)   	TLS 1.2 > h2   	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH x25519  FS
Android 8.1 	RSA 4096 (SHA256)   	TLS 1.2 > h2   	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH x25519  FS
Android 9.0 	RSA 4096 (SHA256)   	TLS 1.2 > h2   	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH x25519  FS
BingPreview Jan 2015 	RSA 4096 (SHA256)   	TLS 1.2 	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
Chrome 49 / XP SP3 	RSA 4096 (SHA256)   	TLS 1.2 > h2   	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
Chrome 69 / Win 7  R		RSA 4096 (SHA256)   	TLS 1.2 > h2   	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH x25519  FS
Chrome 70 / Win 10 	RSA 4096 (SHA256)   	TLS 1.2 > h2   	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH x25519  FS
Chrome 80 / Win 10  R		RSA 4096 (SHA256)   	TLS 1.2 > h2   	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH x25519  FS
Firefox 31.3.0 ESR / Win 7 	RSA 4096 (SHA256)   	TLS 1.2 	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
Firefox 47 / Win 7  R		RSA 4096 (SHA256)   	TLS 1.2 > h2   	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
Firefox 49 / XP SP3 	RSA 4096 (SHA256)   	TLS 1.2 > h2   	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
Firefox 62 / Win 7  R		RSA 4096 (SHA256)   	TLS 1.2 > h2   	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH x25519  FS
Firefox 73 / Win 10  R		RSA 4096 (SHA256)   	TLS 1.2 > h2   	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH x25519  FS
Googlebot Feb 2018 	RSA 4096 (SHA256)   	TLS 1.2 	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH x25519  FS
IE 11 / Win 7  R		RSA 4096 (SHA256)   	TLS 1.2 	TLS_DHE_RSA_WITH_AES_128_GCM_SHA256   DH 4096  FS
IE 11 / Win 8.1  R		RSA 4096 (SHA256)   	TLS 1.2 > http/1.1   	TLS_DHE_RSA_WITH_AES_128_GCM_SHA256   DH 4096  FS
IE 11 / Win Phone 8.1  R		Server sent fatal alert: handshake_failure
IE 11 / Win Phone 8.1 Update  R		RSA 4096 (SHA256)   	TLS 1.2 > http/1.1   	TLS_DHE_RSA_WITH_AES_128_GCM_SHA256   DH 4096  FS
IE 11 / Win 10  R		RSA 4096 (SHA256)   	TLS 1.2 > h2   	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
Edge 15 / Win 10  R		RSA 4096 (SHA256)   	TLS 1.2 > h2   	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH x25519  FS
Edge 16 / Win 10  R		RSA 4096 (SHA256)   	TLS 1.2 > h2   	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH x25519  FS
Edge 18 / Win 10  R		RSA 4096 (SHA256)   	TLS 1.2 > h2   	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH x25519  FS
Edge 13 / Win Phone 10  R		RSA 4096 (SHA256)   	TLS 1.2 > h2   	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
Java 8u161 	RSA 4096 (SHA256)   	TLS 1.2 	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
Java 11.0.3 	RSA 4096 (SHA256)   	TLS 1.2 	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
Java 12.0.1 	RSA 4096 (SHA256)   	TLS 1.2 	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
OpenSSL 1.0.1l  R		RSA 4096 (SHA256)   	TLS 1.2 	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
OpenSSL 1.0.2s  R		RSA 4096 (SHA256)   	TLS 1.2 	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
OpenSSL 1.1.0k  R		RSA 4096 (SHA256)   	TLS 1.2 	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH x25519  FS
OpenSSL 1.1.1c  R		RSA 4096 (SHA256)   	TLS 1.2 	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH x25519  FS
Safari 6 / iOS 6.0.1 	Server sent fatal alert: handshake_failure
Safari 7 / iOS 7.1  R		Server sent fatal alert: handshake_failure
Safari 7 / OS X 10.9  R		Server sent fatal alert: handshake_failure
Safari 8 / iOS 8.4  R		Server sent fatal alert: handshake_failure
Safari 8 / OS X 10.10  R		Server sent fatal alert: handshake_failure
Safari 9 / iOS 9  R		RSA 4096 (SHA256)   	TLS 1.2 > h2   	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
Safari 9 / OS X 10.11  R		RSA 4096 (SHA256)   	TLS 1.2 > h2   	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
Safari 10 / iOS 10  R		RSA 4096 (SHA256)   	TLS 1.2 > h2   	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
Safari 10 / OS X 10.12  R		RSA 4096 (SHA256)   	TLS 1.2 > h2   	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
Safari 12.1.2 / MacOS 10.14.6 Beta  R		RSA 4096 (SHA256)   	TLS 1.2 > h2   	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH x25519  FS
Safari 12.1.1 / iOS 12.3.1  R		RSA 4096 (SHA256)   	TLS 1.2 > h2   	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH x25519  FS
Apple ATS 9 / iOS 9  R		RSA 4096 (SHA256)   	TLS 1.2 > h2   	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
Yahoo Slurp Jan 2015 	RSA 4096 (SHA256)   	TLS 1.2 	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
YandexBot Jan 2015 	RSA 4096 (SHA256)   	TLS 1.2 	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
# Not simulated clients (Protocol mismatch)

Click here to expand
(1) Clients that do not support Forward Secrecy (FS) are excluded when determining support for it.
(2) No support for virtual SSL hosting (SNI). Connects to the default site if the server uses SNI.
(3) Only first connection attempt simulated. Browsers sometimes retry with a lower protocol version.
(R) Denotes a reference browser or client, with which we expect better effective security.
(All) We use defaults, but some platforms do not use their best protocols and features (e.g., Java 6 & 7, older IE).
(All) Certificate trust is not checked in handshake simulation, we only perform TLS handshake.


Protocol Details
DROWN 	No, server keys and hostname not seen elsewhere with SSLv2
(1) For a better understanding of this test, please read this longer explanation
(2) Key usage data kindly provided by the Censys network search engine; original DROWN website here
(3) Censys data is only indicative of possible key and certificate reuse; possibly out-of-date and not complete
Secure Renegotiation 	Supported
Secure Client-Initiated Renegotiation 	No
Insecure Client-Initiated Renegotiation 	No
BEAST attack 	Mitigated server-side (more info)  
POODLE (SSLv3) 	No, SSL 3 not supported (more info)
POODLE (TLS) 	No (more info)
Zombie POODLE 	No (more info)  
GOLDENDOODLE 	No (more info)  
OpenSSL 0-Length 	No (more info)  
Sleeping POODLE 	No (more info)  
Downgrade attack prevention 	Unknown (requires support for at least two protocols, excl. SSL2)
SSL/TLS compression 	No
RC4 	No
Heartbeat (extension) 	No
Heartbleed (vulnerability) 	No (more info)
Ticketbleed (vulnerability) 	No (more info)
OpenSSL CCS vuln. (CVE-2014-0224) 	No (more info)
OpenSSL Padding Oracle vuln.
(CVE-2016-2107) 	No (more info)
ROBOT (vulnerability) 	No (more info)
Forward Secrecy 	Yes (with most browsers)   ROBUST (more info)
ALPN 	Yes   h2 http/1.1
NPN 	No
Session resumption (caching) 	Yes
Session resumption (tickets) 	No
OCSP stapling 	Yes
Strict Transport Security (HSTS) 	Yes
max-age=15768000;includeSubdomains
HSTS Preloading 	Not in: Chrome  Edge  Firefox  IE 
Public Key Pinning (HPKP) 	No (more info)
Public Key Pinning Report-Only 	No
Public Key Pinning (Static) 	No (more info)
Long handshake intolerance 	No
TLS extension intolerance 	No
TLS version intolerance 	No
Incorrect SNI alerts 	No
Uses common DH primes 	No
DH public server param (Ys) reuse 	No
ECDH public server param reuse 	No
Supported Named Groups 	x25519, secp256r1, x448, secp521r1, secp384r1 (server preferred order)
SSL 2 handshake compatibility 	Yes

```
 2020-09-08 16:48:27 +02:00
szaimen 3e5947b755
remove TLS_INSTALL from the lib (#1424) 2020-09-08 10:34:31 +02:00
szaimen 4a6402ebfd
fix last subdomain occurences and remove print_text_in_color before a yesno_box (#1421) 2020-09-07 22:10:43 +02:00
Daniel Hansson 1857c63ec5
ask if the domain is correct (#1418) 2020-09-07 16:06:19 +02:00
szaimen cbc20d1881
add yesno_box_no and yesno_box_yes (#1409) 
Co-authored-by: Daniel Hansson <github@hanssonit.se>
 2020-09-07 11:44:43 +02:00
szaimen c42ec1d992
add SCRIPT_NAME to all scripts and standardize whiptail-titles (#1400) 
Signed-off-by: enoch85 <github@hanssonit.se>

Co-authored-by: enoch85 <github@hanssonit.se>
 2020-09-04 09:05:47 +02:00