Project

General

Profile

Download (17 KB) Statistics
| Branch: | Tag: | Revision:
1
<?php
2
/* $Id$ */
3
/*
4
	system_advanced_admin.php
5
	part of pfSense
6
	Copyright (C) 2005-2007 Scott Ullrich
7

    
8
	Copyright (C) 2008 Shrew Soft Inc
9

    
10
	originally part of m0n0wall (http://m0n0.ch/wall)
11
	Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>.
12
	All rights reserved.
13

    
14
	Redistribution and use in source and binary forms, with or without
15
	modification, are permitted provided that the following conditions are met:
16

    
17
	1. Redistributions of source code must retain the above copyright notice,
18
	   this list of conditions and the following disclaimer.
19

    
20
	2. Redistributions in binary form must reproduce the above copyright
21
	   notice, this list of conditions and the following disclaimer in the
22
	   documentation and/or other materials provided with the distribution.
23

    
24
	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
25
	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
26
	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
27
	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
28
	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
29
	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
30
	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
31
	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
32
	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
33
	POSSIBILITY OF SUCH DAMAGE.
34
*/
35
/*
36
	pfSense_BUILDER_BINARIES:	/usr/bin/killall
37
	pfSense_MODULE:	system
38
*/
39

    
40
##|+PRIV
41
##|*IDENT=page-system-advanced-admin
42
##|*NAME=System: Advanced: Admin Access Page
43
##|*DESCR=Allow access to the 'System: Advanced: Admin Access' page.
44
##|*MATCH=system_advanced_admin.php*
45
##|-PRIV
46

    
47
require("guiconfig.inc");
48
require_once("functions.inc");
49
require_once("filter.inc");
50
require_once("shaper.inc");
51

    
52
$pconfig['webguiproto'] = $config['system']['webgui']['protocol'];
53
$pconfig['webguiport'] = $config['system']['webgui']['port'];
54
$pconfig['ssl-certref'] = $config['system']['webgui']['ssl-certref'];
55
$pconfig['disablehttpredirect'] = isset($config['system']['disablehttpredirect']);
56
$pconfig['disableconsolemenu'] = isset($config['system']['disableconsolemenu']);
57
$pconfig['noantilockout'] = isset($config['system']['webgui']['noantilockout']);
58
$pconfig['nodnsrebindcheck'] = isset($config['system']['webgui']['nodnsrebindcheck']);
59
$pconfig['noantilockout'] = isset($config['system']['webgui']['noantilockout']);
60
$pconfig['enableserial'] = $config['system']['enableserial'];
61
$pconfig['enablesshd'] = $config['system']['enablesshd'];
62
$pconfig['sshport'] = $config['system']['ssh']['port'];
63
$pconfig['sshdkeyonly'] = isset($config['system']['ssh']['sshdkeyonly']);
64

    
65
$a_cert =& $config['system']['cert'];
66

    
67
$certs_available = false;
68
if (is_array($a_cert) && count($a_cert))
69
	$certs_available = true;
70

    
71
if (!$pconfig['webguiproto'] || !$certs_available)
72
	$pconfig['webguiproto'] = "http";
73

    
74
if ($_POST) {
75

    
76
	unset($input_errors);
77
	$pconfig = $_POST;
78

    
79
	/* input validation */
80
	if ($_POST['webguiport'])
81
		if(!is_port($_POST['webguiport']))
82
			$input_errors[] = gettext("You must specify a valid webConfigurator port number");
83

    
84
	if ($_POST['sshport'])
85
		if(!is_port($_POST['sshport']))
86
			$input_errors[] = gettext("You must specify a valid port number");
87

    
88
	if($_POST['sshdkeyonly'] == "yes")
89
		$config['system']['ssh']['sshdkeyonly'] = "enabled";
90
	else if (isset($config['system']['ssh']['sshdkeyonly']))
91
		unset($config['system']['ssh']['sshdkeyonly']);
92

    
93
	ob_flush();
94
	flush();
95

    
96
	if (!$input_errors) {
97

    
98
		if (update_if_changed("webgui protocol", $config['system']['webgui']['protocol'], $_POST['webguiproto']))
99
			$restart_webgui = true;
100
		if (update_if_changed("webgui port", $config['system']['webgui']['port'], $_POST['webguiport']))
101
			$restart_webgui = true;
102
		if (update_if_changed("webgui certificate", $config['system']['webgui']['ssl-certref'], $_POST['ssl-certref']))
103
			$restart_webgui = true;
104

    
105
		if ($_POST['disablehttpredirect'] == "yes") {
106
			$config['system']['disablehttpredirect'] = true;
107
			$restart_webgui = true;
108
		} else {
109
			unset($config['system']['disablehttpredirect']);
110
			$restart_webgui = true;
111
		}
112

    
113
		if($_POST['disableconsolemenu'] == "yes") {
114
			$config['system']['disableconsolemenu'] = true;
115
			auto_login();
116
		} else {
117
			unset($config['system']['disableconsolemenu']);
118
			auto_login();
119
		}
120

    
121
		if ($_POST['noantilockout'] == "yes")
122
			$config['system']['webgui']['noantilockout'] = true;
123
		else
124
			unset($config['system']['webgui']['noantilockout']);
125

    
126
		if ($_POST['enableserial'] == "yes")
127
			$config['system']['enableserial'] = true;
128
		else
129
			unset($config['system']['enableserial']);
130

    
131
		if ($_POST['nodnsrebindcheck'] == "yes")
132
			$config['system']['webgui']['nodnsrebindcheck'] = true;
133
		else
134
			unset($config['system']['webgui']['nodnsrebindcheck']);
135

    
136
		$sshd_enabled = $config['system']['enablesshd'];
137
		if($_POST['enablesshd'])
138
			$config['system']['enablesshd'] = "enabled";
139
		else
140
			unset($config['system']['enablesshd']);
141

    
142
		$sshd_keyonly = isset($config['system']['sshdkeyonly']);
143
		if ($_POST['sshdkeyonly'])
144
			$config['system']['sshdkeyonly'] = true;
145
		else
146
			unset($config['system']['sshdkeyonly']);
147

    
148
		$sshd_port = $config['system']['ssh']['port'];
149
		if ($_POST['sshport'])
150
			$config['system']['ssh']['port'] = $_POST['sshport'];
151
		else if (isset($config['system']['ssh']['port']))
152
			unset($config['system']['ssh']['port']);
153

    
154
		if (($sshd_enabled != $config['system']['enablesshd']) ||
155
			($sshd_keyonly != $config['system']['sshdkeyonly']) ||
156
			($sshd_port != $config['system']['ssh']['port']))
157
			$restart_sshd = true;
158

    
159
		if ($restart_webgui) {
160
			global $_SERVER;
161
			list($host) = explode(":", $_SERVER['HTTP_HOST']);
162
			$prot = $config['system']['webgui']['protocol'];
163
			$port = $config['system']['webgui']['port'];
164
			if ($port)
165
				$url = "{$prot}://{$host}:{$port}/system_advanced_admin.php";
166
			else
167
				$url = "{$prot}://{$host}/system_advanced_admin.php";
168
		}
169

    
170
		write_config();
171

    
172
		$retval = filter_configure();
173
	    $savemsg = get_std_save_message($retval);
174

    
175
		if ($restart_webgui)
176
			$savemsg .= sprintf("<br />" . gettext("One moment...redirecting to %s in 20 seconds."),$url);
177

    
178
		conf_mount_rw();
179
		setup_serial_port();
180
		conf_mount_ro();
181
	}
182
}
183

    
184
$pgtitle = array(gettext("System"),gettext("Advanced: Admin Access"));
185
include("head.inc");
186

    
187
?>
188

    
189
<body link="#0000CC" vlink="#0000CC" alink="#0000CC">
190
<?php include("fbegin.inc"); ?>
191
<script language="JavaScript">
192
<!--
193

    
194
function prot_change() {
195

    
196
	if (document.iform.https_proto.checked)
197
		document.getElementById("ssl_opts").style.display="";
198
	else
199
		document.getElementById("ssl_opts").style.display="none";
200
}
201

    
202
//-->
203
</script>
204
<?php
205
	if ($input_errors)
206
		print_input_errors($input_errors);
207
	if ($savemsg)
208
		print_info_box($savemsg);
209
?>
210
	<form action="system_advanced_admin.php" method="post" name="iform" id="iform">
211
		<table width="100%" border="0" cellpadding="0" cellspacing="0">
212
			<tr>
213
				<td>
214
					<?php
215
						$tab_array = array();
216
						$tab_array[] = array(gettext("Admin Access"), true, "system_advanced_admin.php");
217
						$tab_array[] = array(gettext("Firewall / NAT"), false, "system_advanced_firewall.php");
218
						$tab_array[] = array(gettext("Networking"), false, "system_advanced_network.php");
219
						$tab_array[] = array(gettext("Miscellaneous"), false, "system_advanced_misc.php");
220
						$tab_array[] = array(gettext("System Tunables"), false, "system_advanced_sysctl.php");
221
						$tab_array[] = array(gettext("Notifications"), false, "system_advanced_notifications.php");
222
						display_top_tabs($tab_array);
223
					?>
224
				</td>
225
			</tr>
226
			<tr>
227
				<td id="mainarea">
228
					<div class="tabcont">
229
						<span class="vexpl">
230
							<span class="red">
231
								<strong><?=gettext("NOTE"); ?>:&nbsp</strong>
232
							</span>
233
							<?=gettext("The options on this page are intended for use by advanced users only."); ?>
234
							<br/>
235
						</span>
236
						<br/>
237
						<table width="100%" border="0" cellpadding="6" cellspacing="0">
238
							<tr>
239
								<td colspan="2" valign="top" class="listtopic"><?=gettext("webConfigurator"); ?></td>
240
							</tr>
241
							<tr>
242
								<td width="22%" valign="top" class="vncell"><?=gettext("Protocol"); ?></td>
243
								<td width="78%" class="vtable">
244
									<?php
245
										if ($pconfig['webguiproto'] == "http")
246
											$http_chk = "checked";
247
										if ($pconfig['webguiproto'] == "https")
248
											$https_chk = "checked";
249
										if (!$certs_available)
250
											$https_disabled = "disabled";
251
									?>
252
									<input name="webguiproto" id="http_proto" type="radio" value="http" <?=$http_chk;?> onClick="prot_change()">
253
									HTTP
254
									&nbsp;&nbsp;&nbsp;
255
									<input name="webguiproto" id="https_proto" type="radio" value="https" <?=$https_chk;?> <?=$https_disabled;?> onClick="prot_change()">
256
									HTTPS
257
									<?php if (!$certs_available): ?>
258
									<br/>
259
									<?=gettext("No Certificates have been defined. You must"); ?>
260
									<a href="system_certmanager.php"><?=gettext("Create or Import"); ?></a>
261
									<?=gettext("a Certificate before SSL can be enabled."); ?>
262
									<?php endif; ?>
263
								</td>
264
							</tr>
265
							<tr id="ssl_opts">
266
								<td width="22%" valign="top" class="vncell"><?=gettext("SSL Certificate"); ?></td>
267
								<td width="78%" class="vtable">
268
									<select name="ssl-certref" id="ssl-certref" class="formselect">
269
										<?php
270
											foreach($a_cert as $cert):
271
												$selected = "";
272
												if ($pconfig['ssl-certref'] == $cert['refid'])
273
													$selected = "selected";
274
										?>
275
										<option value="<?=$cert['refid'];?>"<?=$selected;?>><?=$cert['name'];?></option>
276
										<?php endforeach; ?>
277
									</select>
278
								</td>
279
							</tr>
280
							<tr>
281
								<td valign="top" class="vncell"><?=gettext("TCP port"); ?></td>
282
								<td class="vtable">
283
									<input name="webguiport" type="text" class="formfld unknown" id="webguiport" "size="5" value="<?=htmlspecialchars($config['system']['webgui']['port']);?>">
284
									<br>
285
									<span class="vexpl">
286
										<?=gettext("Enter a custom port number for the webConfigurator " .
287
										"above if you want to override the default (80 for HTTP, 443 " .
288
										"for HTTPS). Changes will take effect immediately after save."); ?>
289
									</span>
290
								</td>
291
							</tr>
292
							<tr>
293
								<td width="22%" valign="top" class="vncell"><?=gettext("WebGUI redirect"); ?></td>
294
								<td width="78%" class="vtable">
295
									<input name="disablehttpredirect" type="checkbox" id="disablehttpredirect" value="yes" <?php if ($pconfig['disablehttpredirect']) echo "checked"; ?> />
296
									<strong><?=gettext("Disable webConfigurator redirect rule"); ?></strong>
297
									<br/>
298
									<?php gettext("When this is unchecked, access to the webConfigurator " .
299
									"is always permitted even on port 80, regardless of the listening port configured." .
300
									"Check this box to disable this automatically added redirect rule. ");
301
									?>
302
								</td>
303
							</tr>
304
							<tr>
305
								<td width="22%" valign="top" class="vncell"><?=gettext("Anti-lockout"); ?></td>
306
								<td width="78%" class="vtable">
307
									<?php
308
										if($config['interfaces']['lan']) 
309
											$lockout_interface = "LAN";
310
										else 
311
											$lockout_interface = "WAN";
312
									?>
313
									<input name="noantilockout" type="checkbox" id="noantilockout" value="yes" <?php if ($pconfig['noantilockout']) echo "checked"; ?> />
314
									<strong><?=gettext("Disable webConfigurator anti-lockout rule"); ?></strong>
315
									<br/>
316
									<?php sprintf(gettext("When this is unchecked, access to the webConfigurator " .
317
									"on the %s interface is always permitted, regardless of the user-defined firewall " .
318
									"rule set. Check this box to disable this automatically added rule, so access " .
319
									"to the webConfigurator is controlled by the user-defined firewall rules " .
320
									"(ensure you have a firewall rule in place that allows you in, or you will " .
321
									"lock yourself out!)"), $lockout_interface); ?>
322
									<em> <?=gettext("Hint: the &quot;Set interface(s) IP address&quot; option in the console menu resets this setting as well."); ?> </em>
323
								</td>
324
							</tr>
325
							<tr>
326
								<td width="22%" valign="top" class="vncell"><?=gettext("DNS Rebind Check"); ?></td>
327
								<td width="78%" class="vtable">
328
									<input name="nodnsrebindcheck" type="checkbox" id="nodnsrebindcheck" value="yes" <?php if ($pconfig['nodnsrebindcheck']) echo "checked"; ?> />
329
									<strong><?=gettext("Disable webConfigurator DNS Rebinding Checks"); ?></strong>
330
									<br/>
331
									<?php echo gettext("When this is unchecked, access to the webConfigurator " .
332
									"is protected against <a href=\"http://en.wikipedia.org/wiki/DNS_rebinding\">DNS Rebinding attacks</a>. " .
333
									"Check this box to disable this protection if you find that it interferes with " .
334
									"webConfigurator access in certain corner cases. "); ?>
335
								</td>
336
							</tr>
337
							<tr>
338
								<td colspan="2" class="list" height="12">&nbsp;</td>
339
							</tr>
340
							<tr>
341
								<td colspan="2" valign="top" class="listtopic"><?=gettext("Secure Shell"); ?></td>
342
							</tr>
343
							<tr>
344
								<td width="22%" valign="top" class="vncell"><?=gettext("Secure Shell Server"); ?></td>
345
								<td width="78%" class="vtable">
346
									<input name="enablesshd" type="checkbox" id="enablesshd" value="yes" <?php if (isset($pconfig['enablesshd'])) echo "checked"; ?> />
347
									<strong><?=gettext("Enable Secure Shell"); ?></strong>
348
								</td>
349
							</tr>
350
							<tr>
351
								<td width="22%" valign="top" class="vncell"><?=gettext("Authentication Method"); ?></td>
352
								<td width="78%" class="vtable">
353
									<input name="sshdkeyonly" type="checkbox" id="sshdkeyonly" value="yes" <?php if ($pconfig['sshdkeyonly']) echo "checked"; ?> />
354
									<strong><?=gettext("Disable password login for Secure Shell (RSA key only)"); ?></strong>
355
									<br/>
356
									<?=gettext("When enabled, authorized keys need to be configured for each"); ?>
357
									<a href="system_usermanager.php"><?=gettext("user"); ?></a>
358
									<?=gettext("that has been granted secure shell access."); ?>
359
								</td>
360
							</tr>
361
							<tr>
362
								<td width="22%" valign="top" class="vncell"><?=gettext("SSH port"); ?></td>
363
								<td width="78%" class="vtable">
364
									<input name="sshport" type="text" id="sshport" value="<?php echo $pconfig['sshport']; ?>" />
365
									<br/>
366
									<span class="vexpl"><?=gettext("Note: Leave this blank for the default of 22."); ?></span>
367
								</td>
368
							</tr>
369
							<tr>
370
								<td colspan="2" class="list" height="12">&nbsp;</td>
371
							</tr>
372
							<?php if($g['platform'] == "pfSense" || $g['platform'] == "cdrom"): ?>
373
							<tr>
374
								<td colspan="2" valign="top" class="listtopic"><?=gettext("Serial Communcations"); ?></td>
375
							</tr>
376
							<tr>
377
								<td width="22%" valign="top" class="vncell"><?=gettext("Serial Terminal"); ?></td>
378
								<td width="78%" class="vtable">
379
									<input name="enableserial" type="checkbox" id="enableserial" value="yes" <?php if (isset($pconfig['enableserial'])) echo "checked"; ?> />
380
									<strong><?=gettext("This will enable the first serial port with 9600/8/N/1"); ?></strong>
381
									<br>
382
									<span class="vexpl"><?=gettext("Note:  This will disable the internal video card/keyboard"); ?></span>
383
								</td>
384
							</tr>
385
							<tr>
386
								<td colspan="2" class="list" height="12">&nbsp;</td>
387
							</tr>
388
							<?php endif; ?>
389
							<tr>
390
								<td colspan="2" valign="top" class="listtopic"><?=gettext("Console Options"); ?></td>
391
							</tr>
392
							<tr>
393
								<td width="22%" valign="top" class="vncell"><?=gettext("Console menu"); ?></td>
394
								<td width="78%" class="vtable">
395
									<input name="disableconsolemenu" type="checkbox" id="disableconsolemenu" value="yes" <?php if ($pconfig['disableconsolemenu']) echo "checked"; ?>  />
396
									<strong><?=gettext("Password protect the console menu"); ?></strong>
397
									<br/>
398
									<span class="vexpl"><?=gettext("Changes to this option will take effect after a reboot."); ?></span>
399
								</td>
400
							</tr>
401
							<tr>
402
								<td colspan="2" class="list" height="12">&nbsp;</td>
403
							</tr>							
404
							<tr>
405
								<td width="22%" valign="top">&nbsp;</td>
406
								<td width="78%"><input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save");?>" /></td>
407
							</tr>
408
							<tr>
409
								<td colspan="2" class="list" height="12">&nbsp;</td>
410
							</tr>
411
						</table>
412
					</div>
413
				</td>
414
			</tr>
415
		</table>
416
	</form>
417
	<script language="JavaScript" type="text/javascript">
418
	<!--
419
		prot_change();
420
	//-->
421
	</script>
422

    
423
<?php include("fend.inc"); ?>
424
<?php
425
	if ($restart_webgui)
426
		echo "<meta http-equiv=\"refresh\" content=\"20;url={$url}\">";
427
?>
428
</body>
429
</html>
430

    
431
<?php
432
if ($restart_sshd) {
433

    
434
	killbyname("sshd");
435
	log_error(gettext("secure shell configuration has changed. Stopping sshd."));
436

    
437
	if ($config['system']['enablesshd']) {
438
		log_error(gettext("secure shell configuration has changed. Restarting sshd."));
439
		touch("{$g['tmp_path']}/start_sshd");
440
	}
441
}
442
if ($restart_webgui) {
443
	ob_flush();
444
	flush();
445
	log_error(gettext("webConfigurator configuration has changed. Restarting webConfigurator."));
446
	touch("{$g['tmp_path']}/restart_webgui");
447
}
448

    
449
?>
(172-172/221)