mirror of
https://github.com/xcat2/xcat-core.git
synced 2026-07-31 18:19:40 +00:00
Vinícius Ferrão
9261a765bd
Add standard security response headers (X-Frame-Options, X-Content-Type- Options, Content-Security-Policy, X-Permitted-Cross-Domain-Policies) to the /install and /tftpboot directories, mask the server banner with "ServerTokens Prod", and drop the Includes (SSI) and MultiViews options from those file-serving directories. Indexes on /install/postscripts, /install/post and the doc directory are left intact so directory browsing still works where xCAT relies on it. The Header directives are wrapped in <IfModule mod_headers.c> so a server whose mod_headers is not loaded still starts cleanly instead of failing on an unknown directive. On Debian/Ubuntu, where mod_headers is not enabled by default, the xCAT and xCATsn package postinst scripts run "a2enmod headers" before restarting Apache so the headers take effect there as well; on RHEL/SLES the module is loaded by default and needs no action. Recovered from the unmerged lenovobuild branch (originals7ee0c129,85c8bc09,d4d1783a), adapted: the deprecated X-XSS-Protection header and the mod_allowmethods-dependent AllowMethods directive are omitted, and the Header directives use "set" rather than "append". Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
94 lines
2.8 KiB
Bash
94 lines
2.8 KiB
Bash
#!/bin/sh
|
|
# postinst script for openmpi
|
|
#
|
|
# see: dh_installdeb(1)
|
|
|
|
set -e
|
|
|
|
# summary of how this script can be called:
|
|
# * <postinst> `configure' <most-recently-configured-version>
|
|
# * <old-postinst> `abort-upgrade' <new version>
|
|
# * <conflictor's-postinst> `abort-remove' `in-favour' <package>
|
|
# <new-version>
|
|
# * <postinst> `abort-remove'
|
|
# * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
|
|
# <failed-install-package> <version> `removing'
|
|
# <conflicting-package> <version>
|
|
# for details, see http://www.debian.org/doc/debian-policy/ or
|
|
# the debian-policy package
|
|
|
|
|
|
case "$1" in
|
|
configure)
|
|
# so conserver will start
|
|
mkdir -p /var/log/consoles
|
|
|
|
# remove any management node file
|
|
if [ -f /etc/xCATMN ]; then
|
|
rm /etc/xCATMN
|
|
fi
|
|
|
|
#ver=$(cat /etc/issue |awk '{print $2}')
|
|
#num=${ver%.*}
|
|
#file="xcat.conf.apach24"
|
|
#if [ $num -gt 12 ];then
|
|
# mv /etc/apache2/conf.d/xcat.conf.apach24 /etc/apache2/conf-enabled/
|
|
#fi
|
|
if [ -n "$(httpd -v 2>&1 |grep -e '^Server version\s*:.*\/2.4')" ]
|
|
then
|
|
rm -rf /etc/httpd/conf.d/xcat.conf
|
|
ln -s /etc/xcat/conf.orig/xcat.conf.apach24 /etc/httpd/conf.d/xcat.conf
|
|
fi
|
|
|
|
if [ -n "$(apachectl -v 2>&1 |grep -e '^Server version\s*:.*\/2.4')" ]
|
|
then
|
|
rm -rf /etc/apache2/conf-enabled/xcat.conf
|
|
ln -s /etc/apache2/conf-available/xcat.conf.apach24 /etc/apache2/conf-enabled/xcat.conf
|
|
fi
|
|
|
|
if [ -n "$(apache2ctl -v 2>&1 |grep -e '^Server version\s*:.*\/2.4')" ]
|
|
then
|
|
rm -rf /etc/apache2/conf-enabled/xcat.conf
|
|
ln -s /etc/apache2/conf-available/xcat.conf.apach24 /etc/apache2/conf-enabled/xcat.conf
|
|
fi
|
|
|
|
apachedaemon='apache2'
|
|
|
|
update-rc.d $apachedaemon enable
|
|
|
|
# xcat.conf sets security response headers via mod_headers, which is not
|
|
# enabled by default on Debian/Ubuntu. Enable it so the headers take
|
|
# effect (directives are wrapped in <IfModule mod_headers.c> so a missing
|
|
# module never breaks the apache reload below).
|
|
if command -v a2enmod >/dev/null 2>&1; then
|
|
a2enmod -q headers >/dev/null 2>&1 || :
|
|
fi
|
|
|
|
if [ -f "/proc/cmdline" ]; then # prevent running it during install into chroot image
|
|
if [ -d /run/systemd/system ] && command -v systemctl >/dev/null 2>&1; then
|
|
systemctl start xcatd.service
|
|
elif [ -x /etc/init.d/xcatd ]; then
|
|
XCATROOT=/opt/xcat /etc/init.d/xcatd start
|
|
fi
|
|
/etc/init.d/$apachedaemon reload
|
|
fi
|
|
echo "xCATsn is now installed"
|
|
|
|
;;
|
|
|
|
abort-upgrade|abort-remove|abort-deconfigure)
|
|
;;
|
|
|
|
*)
|
|
echo "postinst called with unknown argument \`$1'" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
# dh_installdeb will replace this with shell code automatically
|
|
# generated by other debhelper scripts.
|
|
|
|
#DEBHELPER#
|
|
|
|
exit 0
|