Merge lp:~gnuoy/charms/precise/apache2/24-auth-format into lp:charms/apache2

[Liam Young]

The acl syntax has changed between apache 2.2 and apache 2.4 ( http://httpd.apache.org/docs/2.4/upgrading.html ) and Trusty has 2.4

The default security conf created by the charm uses the 2.2 syntax. This mp is to switch it to use the 2.4 if 2.4 is installed.

Here's the output of the tests I ran to check that access to directories other than /var/www was still blocked and that the deny could be overridded in a hosts file:

ubuntu@gnuoy-bastion:~$ cat vhost-denied.txt
<VirtualHost *:80>
    DocumentRoot /srv/website
</VirtualHost>

ubuntu@gnuoy-bastion:~$ cat vhost-precise-allowed.txt
<VirtualHost *:80>
    DocumentRoot /srv/website

    <Directory /srv/website>
         Order allow,deny
         Allow from all
    </Directory>
</VirtualHost>

ubuntu@gnuoy-bastion:~$ cat vhost-trusty-allowed.txt
<VirtualHost *:80>
    DocumentRoot /srv/website

    <Directory /srv/website>
        Require all granted
    </Directory>
</VirtualHost>

ubuntu@gnuoy-bastion:~$ juju deploy local:precise/apache2 apache2-precise
Added charm "local:precise/apache2-0" to the environment.
ubuntu@gnuoy-bastion:~$ juju deploy local:trusty/apache2 apache2-trusty
Added charm "local:trusty/apache2-0" to the environment.

ubuntu@gnuoy-bastion:~$ juju ssh apache2-precise/0 "sudo mkdir /srv/website; sudo cp /var/www/index.html /srv/website"
Connection to 10.5.0.179 closed.
ubuntu@gnuoy-bastion:~$
ubuntu@gnuoy-bastion:~$ juju ssh apache2-trusty/0 "sudo mkdir /srv/website; sudo cp /var/www/html/index.html /srv/website"
Connection to 10.5.0.180 closed.

ubuntu@gnuoy-bastion:~$ juju set apache2-precise "vhost_http_template=$(base64 vhost-denied.txt)"
ubuntu@gnuoy-bastion:~$ juju set apache2-trusty "vhost_http_template=$(base64 vhost-denied.txt)"

ubuntu@gnuoy-bastion:~$ juju ssh apache2-precise/0 "curl -I http://localhost/index.html"
Warning: Permanently added '10.5.0.179' (ECDSA) to the list of known hosts.
HTTP/1.1 403 Forbidden
Date: Tue, 27 May 2014 15:43:30 GMT
Server: Apache/2.2.22 (Ubuntu)
Vary: Accept-Encoding
Content-Type: text/html; charset=iso-8859-1

Connection to 10.5.0.179 closed.
ubuntu@gnuoy-bastion:~$ juju ssh apache2-trusty/0 "curl -I http://localhost/index.html"
Warning: Permanently added '10.5.0.180' (ECDSA) to the list of known hosts.
HTTP/1.1 403 Forbidden
Date: Tue, 27 May 2014 15:43:39 GMT
Server: Apache/2.4.7 (Ubuntu)
Content-Type: text/html; charset=iso-8859-1

Connection to 10.5.0.180 closed.

ubuntu@gnuoy-bastion:~$ juju set apache2-precise "vhost_http_template=$(base64 vhost-precise-allowed.txt)"
ubuntu@gnuoy-bastion:~$ juju set apache2-trusty "vhost_http_template=$(base64 vhost-trusty-allowed.txt)"

ubuntu@gnuoy-bastion:~$ juju ssh apache2-precise/0 "curl -I http://localhost/index.html"
Warning: Permanently added '10.5.0.179' (ECDSA) to the list of known hosts.
HTTP/1.1 200 OK
Date: Tue, 27 May 2014 15:43:57 GMT
Server: Apache/2.2.22 (Ubuntu)
Last-Modified: Tue, 27 May 2014 15:42:48 GMT
ETag: "2057f-b1-4fa638c43b6a9"
Accept-Ranges: bytes
Content-Length: 177
Vary: Accept-Encoding
Content-Type: text/html
X-Pad: avoid browser bug

Connection to 10.5.0.179 closed.
ubuntu@gnuoy-bastion:~$ juju ssh apache2-trusty/0 "curl -I http://localhost/index.html"
Warning: Permanently added '10.5.0.180' (ECDSA) to the list of known hosts.
HTTP/1.1 200 OK
Date: Tue, 27 May 2014 15:44:02 GMT
Server: Apache/2.4.7 (Ubuntu)
Last-Modified: Tue, 27 May 2014 15:43:07 GMT
ETag: "2cf6-4fa638d67edeb"
Accept-Ranges: bytes
Content-Length: 11510
Vary: Accept-Encoding
Content-Type: text/html

Connection to 10.5.0.180 closed.

[Jorge Niedbalski (niedbalski)]

This change LGTM +1. I tried this charm code on my environment with the upstream apache charm and also compared the results with this proposal adding the 'Require all denied' directive does the trick on apache 24 , the HTTP/1.1 403 Forbidden was replaced by a HTTP/1.1 200.

services:
  apache2-precise:
    charm: local:precise/apache2-0
    exposed: false
    units:
      apache2-precise/0:
        agent-state: started
        agent-version: 1.18.4.1
        machine: "3"
        open-ports:
        - 80/tcp
        - 443/tcp
        public-address: 10.0.3.106
  apache2-trusty:
    charm: local:trusty/apache2-1
    exposed: false
    units:
      apache2-trusty/0:
        agent-state: started
        agent-version: 1.18.4.1
        machine: "4"
        open-ports:
        - 80/tcp
        - 443/tcp
        public-address: 10.0.3.3

review: Approve

[Matt Bruzek (mbruzek)]

LGTM!

Thank you for this submission!

review: Approve

=== modified file 'data/security.template'
--- data/security.template	2013-02-04 23:25:08 +0000
+++ data/security.template	2014-05-27 15:52:42 +0000
@@ -8,11 +8,16 @@
 
 <Directory />
        AllowOverride None
+{%- if is_apache24 %}
+       Require all denied
+{%- else %}
        Order Deny,Allow
        Deny from all
+{%- endif %}
 </Directory>
 
 
+
 # Changing the following options will not really affect the security of the
 # server, but might make attacks slightly more difficult in some cases.
 

=== modified file 'hooks/hooks.py'
--- hooks/hooks.py	2014-02-08 15:03:11 +0000
+++ hooks/hooks.py	2014-05-27 15:52:42 +0000
@@ -376,6 +376,7 @@
         'server_tokens': config_data['server_tokens'],
         'server_signature': config_data['server_signature'],
         'trace_enabled': config_data['trace_enabled'],
+        'is_apache24': is_apache24(),
     }
     template = \
         template_env.get_template('security.template').render(templ_vars)