Make Zope management work with non-SSL connections, but give an example
of how to turn it on. Conditionalize the SSL usage on <IfDefine SSL>, since that's been a problem. Also make the rewrite use cgi-bin.default/Zope.cgi, but give an example of what to change if you move it to cgi-bin/Zope.cgi.
This commit is contained in:
Neil Blakey-Milner
parent
bf996d60c3
commit
689945f93e
Notes:
svn2git
2021-03-31 03:12:20 +00:00
svn path=/head/; revision=32842
6 changed files with 150 additions and 114 deletions
|
|
@ -16,33 +16,39 @@ RewriteRule ^/Zope$ /Zope/ [R]
|
|||
# way to do so is to do a little mod_rewrite'ing. See doc/WEBSERVER.txt in
|
||||
# your Zope base directory for further information.
|
||||
#
|
||||
# Uncomment the first RewriteRule if you move Zope.cgi into
|
||||
# /usr/local/www/cgi-bin
|
||||
#
|
||||
# This maps maps /Zope/ to the Zope.cgi CGI script.
|
||||
RewriteCond %{HTTP:Authorization} ^(.*)
|
||||
RewriteRule ^/Zope/(.*) /usr/local/www/cgi-bin/Zope.cgi/$1 [env=HTTP_CGI_AUTHORIZATION:%1,t=application/x-httpd-cgi,l]
|
||||
#RewriteRule ^/Zope/(.*) /usr/local/www/cgi-bin/Zope.cgi/$1 [env=HTTP_CGI_AUTHORIZATION:%1,t=application/x-httpd-cgi,l]
|
||||
RewriteRule ^/Zope/(.*) /usr/local/www/cgi-bin.default/Zope.cgi/$1 [env=HTTP_CGI_AUTHORIZATION:%1,t=application/x-httpd-cgi,l]
|
||||
#
|
||||
|
||||
# *** *** ***
|
||||
#
|
||||
# Also, Zope, in spite of some fussing about "security", totally ignores
|
||||
# the man in the middle. So, all contacts to Zope management screens are
|
||||
# made to require SSL.
|
||||
# This lets the Zope cgi script run:
|
||||
#
|
||||
<LocationMatch "/Zope/(.*)manage(.*)">
|
||||
SSLRequireSSL
|
||||
</LocationMatch>
|
||||
|
||||
<Directory /usr/local/www/cgi-bin.default>
|
||||
Options +ExecCGI
|
||||
</Directory>
|
||||
|
||||
|
||||
# *** *** ***
|
||||
#
|
||||
<LocationMatch "/cgi-bin/Zope.cgi(.*)manage(.*)">
|
||||
SSLRequireSSL
|
||||
</LocationMatch>
|
||||
# To require SSL to access the Zope management screens, uncomment the
|
||||
# next section:
|
||||
#
|
||||
# One final notice: If you can't get working your authentication with Zope
|
||||
# check if the access file in the Zope base directory (maybe this is
|
||||
# /usr/local/www/Zope or the like) contains a CLEARTEXT password. If
|
||||
# encryption there is set to SHA, to my knowledge, authentication does not
|
||||
# work. Try `python zpasswd.py -u zopemaster -p test -e CLEARTEXT access`
|
||||
# (in the Zope base dir). This sets the required username/passwd pair to
|
||||
# zopemaster/test respectively and stores them as CLEARTEXT password.
|
||||
# Don't forget the proper access restrictions to this file if you have
|
||||
# user access to the file system that it is stored on.
|
||||
#<IfDefine SSL>
|
||||
#<LocationMatch "/Zope/(.*)manage(.*)">
|
||||
# SSLRequireSSL
|
||||
#</LocationMatch>
|
||||
#
|
||||
#<LocationMatch "/cgi-bin/Zope.cgi(.*)manage(.*)">
|
||||
# SSLRequireSSL
|
||||
#</LocationMatch>
|
||||
#</IfDefine>
|
||||
#
|
||||
# End of Zope configuration section.
|
||||
|
||||
|
|
|
|||
|
|
@ -16,33 +16,39 @@ RewriteRule ^/Zope$ /Zope/ [R]
|
|||
# way to do so is to do a little mod_rewrite'ing. See doc/WEBSERVER.txt in
|
||||
# your Zope base directory for further information.
|
||||
#
|
||||
# Uncomment the first RewriteRule if you move Zope.cgi into
|
||||
# /usr/local/www/cgi-bin
|
||||
#
|
||||
# This maps maps /Zope/ to the Zope.cgi CGI script.
|
||||
RewriteCond %{HTTP:Authorization} ^(.*)
|
||||
RewriteRule ^/Zope/(.*) /usr/local/www/cgi-bin/Zope.cgi/$1 [env=HTTP_CGI_AUTHORIZATION:%1,t=application/x-httpd-cgi,l]
|
||||
#RewriteRule ^/Zope/(.*) /usr/local/www/cgi-bin/Zope.cgi/$1 [env=HTTP_CGI_AUTHORIZATION:%1,t=application/x-httpd-cgi,l]
|
||||
RewriteRule ^/Zope/(.*) /usr/local/www/cgi-bin.default/Zope.cgi/$1 [env=HTTP_CGI_AUTHORIZATION:%1,t=application/x-httpd-cgi,l]
|
||||
#
|
||||
|
||||
# *** *** ***
|
||||
#
|
||||
# Also, Zope, in spite of some fussing about "security", totally ignores
|
||||
# the man in the middle. So, all contacts to Zope management screens are
|
||||
# made to require SSL.
|
||||
# This lets the Zope cgi script run:
|
||||
#
|
||||
<LocationMatch "/Zope/(.*)manage(.*)">
|
||||
SSLRequireSSL
|
||||
</LocationMatch>
|
||||
|
||||
<Directory /usr/local/www/cgi-bin.default>
|
||||
Options +ExecCGI
|
||||
</Directory>
|
||||
|
||||
|
||||
# *** *** ***
|
||||
#
|
||||
<LocationMatch "/cgi-bin/Zope.cgi(.*)manage(.*)">
|
||||
SSLRequireSSL
|
||||
</LocationMatch>
|
||||
# To require SSL to access the Zope management screens, uncomment the
|
||||
# next section:
|
||||
#
|
||||
# One final notice: If you can't get working your authentication with Zope
|
||||
# check if the access file in the Zope base directory (maybe this is
|
||||
# /usr/local/www/Zope or the like) contains a CLEARTEXT password. If
|
||||
# encryption there is set to SHA, to my knowledge, authentication does not
|
||||
# work. Try `python zpasswd.py -u zopemaster -p test -e CLEARTEXT access`
|
||||
# (in the Zope base dir). This sets the required username/passwd pair to
|
||||
# zopemaster/test respectively and stores them as CLEARTEXT password.
|
||||
# Don't forget the proper access restrictions to this file if you have
|
||||
# user access to the file system that it is stored on.
|
||||
#<IfDefine SSL>
|
||||
#<LocationMatch "/Zope/(.*)manage(.*)">
|
||||
# SSLRequireSSL
|
||||
#</LocationMatch>
|
||||
#
|
||||
#<LocationMatch "/cgi-bin/Zope.cgi(.*)manage(.*)">
|
||||
# SSLRequireSSL
|
||||
#</LocationMatch>
|
||||
#</IfDefine>
|
||||
#
|
||||
# End of Zope configuration section.
|
||||
|
||||
|
|
|
|||
|
|
@ -16,33 +16,39 @@ RewriteRule ^/Zope$ /Zope/ [R]
|
|||
# way to do so is to do a little mod_rewrite'ing. See doc/WEBSERVER.txt in
|
||||
# your Zope base directory for further information.
|
||||
#
|
||||
# Uncomment the first RewriteRule if you move Zope.cgi into
|
||||
# /usr/local/www/cgi-bin
|
||||
#
|
||||
# This maps maps /Zope/ to the Zope.cgi CGI script.
|
||||
RewriteCond %{HTTP:Authorization} ^(.*)
|
||||
RewriteRule ^/Zope/(.*) /usr/local/www/cgi-bin/Zope.cgi/$1 [env=HTTP_CGI_AUTHORIZATION:%1,t=application/x-httpd-cgi,l]
|
||||
#RewriteRule ^/Zope/(.*) /usr/local/www/cgi-bin/Zope.cgi/$1 [env=HTTP_CGI_AUTHORIZATION:%1,t=application/x-httpd-cgi,l]
|
||||
RewriteRule ^/Zope/(.*) /usr/local/www/cgi-bin.default/Zope.cgi/$1 [env=HTTP_CGI_AUTHORIZATION:%1,t=application/x-httpd-cgi,l]
|
||||
#
|
||||
|
||||
# *** *** ***
|
||||
#
|
||||
# Also, Zope, in spite of some fussing about "security", totally ignores
|
||||
# the man in the middle. So, all contacts to Zope management screens are
|
||||
# made to require SSL.
|
||||
# This lets the Zope cgi script run:
|
||||
#
|
||||
<LocationMatch "/Zope/(.*)manage(.*)">
|
||||
SSLRequireSSL
|
||||
</LocationMatch>
|
||||
|
||||
<Directory /usr/local/www/cgi-bin.default>
|
||||
Options +ExecCGI
|
||||
</Directory>
|
||||
|
||||
|
||||
# *** *** ***
|
||||
#
|
||||
<LocationMatch "/cgi-bin/Zope.cgi(.*)manage(.*)">
|
||||
SSLRequireSSL
|
||||
</LocationMatch>
|
||||
# To require SSL to access the Zope management screens, uncomment the
|
||||
# next section:
|
||||
#
|
||||
# One final notice: If you can't get working your authentication with Zope
|
||||
# check if the access file in the Zope base directory (maybe this is
|
||||
# /usr/local/www/Zope or the like) contains a CLEARTEXT password. If
|
||||
# encryption there is set to SHA, to my knowledge, authentication does not
|
||||
# work. Try `python zpasswd.py -u zopemaster -p test -e CLEARTEXT access`
|
||||
# (in the Zope base dir). This sets the required username/passwd pair to
|
||||
# zopemaster/test respectively and stores them as CLEARTEXT password.
|
||||
# Don't forget the proper access restrictions to this file if you have
|
||||
# user access to the file system that it is stored on.
|
||||
#<IfDefine SSL>
|
||||
#<LocationMatch "/Zope/(.*)manage(.*)">
|
||||
# SSLRequireSSL
|
||||
#</LocationMatch>
|
||||
#
|
||||
#<LocationMatch "/cgi-bin/Zope.cgi(.*)manage(.*)">
|
||||
# SSLRequireSSL
|
||||
#</LocationMatch>
|
||||
#</IfDefine>
|
||||
#
|
||||
# End of Zope configuration section.
|
||||
|
||||
|
|
|
|||
|
|
@ -16,33 +16,39 @@ RewriteRule ^/Zope$ /Zope/ [R]
|
|||
# way to do so is to do a little mod_rewrite'ing. See doc/WEBSERVER.txt in
|
||||
# your Zope base directory for further information.
|
||||
#
|
||||
# Uncomment the first RewriteRule if you move Zope.cgi into
|
||||
# /usr/local/www/cgi-bin
|
||||
#
|
||||
# This maps maps /Zope/ to the Zope.cgi CGI script.
|
||||
RewriteCond %{HTTP:Authorization} ^(.*)
|
||||
RewriteRule ^/Zope/(.*) /usr/local/www/cgi-bin/Zope.cgi/$1 [env=HTTP_CGI_AUTHORIZATION:%1,t=application/x-httpd-cgi,l]
|
||||
#RewriteRule ^/Zope/(.*) /usr/local/www/cgi-bin/Zope.cgi/$1 [env=HTTP_CGI_AUTHORIZATION:%1,t=application/x-httpd-cgi,l]
|
||||
RewriteRule ^/Zope/(.*) /usr/local/www/cgi-bin.default/Zope.cgi/$1 [env=HTTP_CGI_AUTHORIZATION:%1,t=application/x-httpd-cgi,l]
|
||||
#
|
||||
|
||||
# *** *** ***
|
||||
#
|
||||
# Also, Zope, in spite of some fussing about "security", totally ignores
|
||||
# the man in the middle. So, all contacts to Zope management screens are
|
||||
# made to require SSL.
|
||||
# This lets the Zope cgi script run:
|
||||
#
|
||||
<LocationMatch "/Zope/(.*)manage(.*)">
|
||||
SSLRequireSSL
|
||||
</LocationMatch>
|
||||
|
||||
<Directory /usr/local/www/cgi-bin.default>
|
||||
Options +ExecCGI
|
||||
</Directory>
|
||||
|
||||
|
||||
# *** *** ***
|
||||
#
|
||||
<LocationMatch "/cgi-bin/Zope.cgi(.*)manage(.*)">
|
||||
SSLRequireSSL
|
||||
</LocationMatch>
|
||||
# To require SSL to access the Zope management screens, uncomment the
|
||||
# next section:
|
||||
#
|
||||
# One final notice: If you can't get working your authentication with Zope
|
||||
# check if the access file in the Zope base directory (maybe this is
|
||||
# /usr/local/www/Zope or the like) contains a CLEARTEXT password. If
|
||||
# encryption there is set to SHA, to my knowledge, authentication does not
|
||||
# work. Try `python zpasswd.py -u zopemaster -p test -e CLEARTEXT access`
|
||||
# (in the Zope base dir). This sets the required username/passwd pair to
|
||||
# zopemaster/test respectively and stores them as CLEARTEXT password.
|
||||
# Don't forget the proper access restrictions to this file if you have
|
||||
# user access to the file system that it is stored on.
|
||||
#<IfDefine SSL>
|
||||
#<LocationMatch "/Zope/(.*)manage(.*)">
|
||||
# SSLRequireSSL
|
||||
#</LocationMatch>
|
||||
#
|
||||
#<LocationMatch "/cgi-bin/Zope.cgi(.*)manage(.*)">
|
||||
# SSLRequireSSL
|
||||
#</LocationMatch>
|
||||
#</IfDefine>
|
||||
#
|
||||
# End of Zope configuration section.
|
||||
|
||||
|
|
|
|||
|
|
@ -16,33 +16,39 @@ RewriteRule ^/Zope$ /Zope/ [R]
|
|||
# way to do so is to do a little mod_rewrite'ing. See doc/WEBSERVER.txt in
|
||||
# your Zope base directory for further information.
|
||||
#
|
||||
# Uncomment the first RewriteRule if you move Zope.cgi into
|
||||
# /usr/local/www/cgi-bin
|
||||
#
|
||||
# This maps maps /Zope/ to the Zope.cgi CGI script.
|
||||
RewriteCond %{HTTP:Authorization} ^(.*)
|
||||
RewriteRule ^/Zope/(.*) /usr/local/www/cgi-bin/Zope.cgi/$1 [env=HTTP_CGI_AUTHORIZATION:%1,t=application/x-httpd-cgi,l]
|
||||
#RewriteRule ^/Zope/(.*) /usr/local/www/cgi-bin/Zope.cgi/$1 [env=HTTP_CGI_AUTHORIZATION:%1,t=application/x-httpd-cgi,l]
|
||||
RewriteRule ^/Zope/(.*) /usr/local/www/cgi-bin.default/Zope.cgi/$1 [env=HTTP_CGI_AUTHORIZATION:%1,t=application/x-httpd-cgi,l]
|
||||
#
|
||||
|
||||
# *** *** ***
|
||||
#
|
||||
# Also, Zope, in spite of some fussing about "security", totally ignores
|
||||
# the man in the middle. So, all contacts to Zope management screens are
|
||||
# made to require SSL.
|
||||
# This lets the Zope cgi script run:
|
||||
#
|
||||
<LocationMatch "/Zope/(.*)manage(.*)">
|
||||
SSLRequireSSL
|
||||
</LocationMatch>
|
||||
|
||||
<Directory /usr/local/www/cgi-bin.default>
|
||||
Options +ExecCGI
|
||||
</Directory>
|
||||
|
||||
|
||||
# *** *** ***
|
||||
#
|
||||
<LocationMatch "/cgi-bin/Zope.cgi(.*)manage(.*)">
|
||||
SSLRequireSSL
|
||||
</LocationMatch>
|
||||
# To require SSL to access the Zope management screens, uncomment the
|
||||
# next section:
|
||||
#
|
||||
# One final notice: If you can't get working your authentication with Zope
|
||||
# check if the access file in the Zope base directory (maybe this is
|
||||
# /usr/local/www/Zope or the like) contains a CLEARTEXT password. If
|
||||
# encryption there is set to SHA, to my knowledge, authentication does not
|
||||
# work. Try `python zpasswd.py -u zopemaster -p test -e CLEARTEXT access`
|
||||
# (in the Zope base dir). This sets the required username/passwd pair to
|
||||
# zopemaster/test respectively and stores them as CLEARTEXT password.
|
||||
# Don't forget the proper access restrictions to this file if you have
|
||||
# user access to the file system that it is stored on.
|
||||
#<IfDefine SSL>
|
||||
#<LocationMatch "/Zope/(.*)manage(.*)">
|
||||
# SSLRequireSSL
|
||||
#</LocationMatch>
|
||||
#
|
||||
#<LocationMatch "/cgi-bin/Zope.cgi(.*)manage(.*)">
|
||||
# SSLRequireSSL
|
||||
#</LocationMatch>
|
||||
#</IfDefine>
|
||||
#
|
||||
# End of Zope configuration section.
|
||||
|
||||
|
|
|
|||
|
|
@ -16,33 +16,39 @@ RewriteRule ^/Zope$ /Zope/ [R]
|
|||
# way to do so is to do a little mod_rewrite'ing. See doc/WEBSERVER.txt in
|
||||
# your Zope base directory for further information.
|
||||
#
|
||||
# Uncomment the first RewriteRule if you move Zope.cgi into
|
||||
# /usr/local/www/cgi-bin
|
||||
#
|
||||
# This maps maps /Zope/ to the Zope.cgi CGI script.
|
||||
RewriteCond %{HTTP:Authorization} ^(.*)
|
||||
RewriteRule ^/Zope/(.*) /usr/local/www/cgi-bin/Zope.cgi/$1 [env=HTTP_CGI_AUTHORIZATION:%1,t=application/x-httpd-cgi,l]
|
||||
#RewriteRule ^/Zope/(.*) /usr/local/www/cgi-bin/Zope.cgi/$1 [env=HTTP_CGI_AUTHORIZATION:%1,t=application/x-httpd-cgi,l]
|
||||
RewriteRule ^/Zope/(.*) /usr/local/www/cgi-bin.default/Zope.cgi/$1 [env=HTTP_CGI_AUTHORIZATION:%1,t=application/x-httpd-cgi,l]
|
||||
#
|
||||
|
||||
# *** *** ***
|
||||
#
|
||||
# Also, Zope, in spite of some fussing about "security", totally ignores
|
||||
# the man in the middle. So, all contacts to Zope management screens are
|
||||
# made to require SSL.
|
||||
# This lets the Zope cgi script run:
|
||||
#
|
||||
<LocationMatch "/Zope/(.*)manage(.*)">
|
||||
SSLRequireSSL
|
||||
</LocationMatch>
|
||||
|
||||
<Directory /usr/local/www/cgi-bin.default>
|
||||
Options +ExecCGI
|
||||
</Directory>
|
||||
|
||||
|
||||
# *** *** ***
|
||||
#
|
||||
<LocationMatch "/cgi-bin/Zope.cgi(.*)manage(.*)">
|
||||
SSLRequireSSL
|
||||
</LocationMatch>
|
||||
# To require SSL to access the Zope management screens, uncomment the
|
||||
# next section:
|
||||
#
|
||||
# One final notice: If you can't get working your authentication with Zope
|
||||
# check if the access file in the Zope base directory (maybe this is
|
||||
# /usr/local/www/Zope or the like) contains a CLEARTEXT password. If
|
||||
# encryption there is set to SHA, to my knowledge, authentication does not
|
||||
# work. Try `python zpasswd.py -u zopemaster -p test -e CLEARTEXT access`
|
||||
# (in the Zope base dir). This sets the required username/passwd pair to
|
||||
# zopemaster/test respectively and stores them as CLEARTEXT password.
|
||||
# Don't forget the proper access restrictions to this file if you have
|
||||
# user access to the file system that it is stored on.
|
||||
#<IfDefine SSL>
|
||||
#<LocationMatch "/Zope/(.*)manage(.*)">
|
||||
# SSLRequireSSL
|
||||
#</LocationMatch>
|
||||
#
|
||||
#<LocationMatch "/cgi-bin/Zope.cgi(.*)manage(.*)">
|
||||
# SSLRequireSSL
|
||||
#</LocationMatch>
|
||||
#</IfDefine>
|
||||
#
|
||||
# End of Zope configuration section.
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue