pfSense

<?php

/* $Id$ */

/*

	system_advanced_admin.php

	part of pfSense

	Copyright (C) 2005-2007 Scott Ullrich

	Copyright (C) 2008 Shrew Soft Inc

	originally part of m0n0wall (http://m0n0.ch/wall)

	Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>.

	All rights reserved.

	Redistribution and use in source and binary forms, with or without

	modification, are permitted provided that the following conditions are met:

	1. Redistributions of source code must retain the above copyright notice,

	   this list of conditions and the following disclaimer.

	2. Redistributions in binary form must reproduce the above copyright

	   notice, this list of conditions and the following disclaimer in the

	   documentation and/or other materials provided with the distribution.

	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,

	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY

	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE

	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,

	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF

	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS

	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN

	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE

	POSSIBILITY OF SUCH DAMAGE.

*/

	pfSense_BUILDER_BINARIES:	/usr/bin/killall

	pfSense_MODULE:	system

*/

##|+PRIV

##|*IDENT=page-system-advanced-admin

##|*NAME=System: Advanced: Admin Access Page

##|*DESCR=Allow access to the 'System: Advanced: Admin Access' page.

##|*MATCH=system_advanced_admin.php*

##|-PRIV

require("guiconfig.inc");

require_once("filter.inc");

require_once("shaper.inc");

$pconfig['webguiport'] = $config['system']['webgui']['port'];

$pconfig['ssl-certref'] = $config['system']['webgui']['ssl-certref'];

$pconfig['noantilockout'] = isset($config['system']['webgui']['noantilockout']);

$pconfig['enablesshd'] = $config['system']['enablesshd'];

$pconfig['sshport'] = $config['system']['ssh']['port'];

$a_cert =& $config['system']['cert'];

$certs_available = false;

if (is_array($a_cert) && count($a_cert))

	$certs_available = true;

if (!$pconfig['webguiproto'] || !$certs_available)

	$pconfig['webguiproto'] = "http";

if ($_POST) {

	unset($input_errors);

	$pconfig = $_POST;

	/* input validation */

		if(!is_port($_POST['webguiport']))

		$althosts = explode(" ", $_POST['althostnames']);

		foreach ($althosts as $ah)

			if (!is_hostname($ah))

				$input_errors[] = gettext("Alternate hostname " . htmlspecialchars($ah) . " is not a valid hostname.");

	}

		if(!is_port($_POST['sshport']))

	if($_POST['sshdkeyonly'] == "yes")

		$config['system']['ssh']['sshdkeyonly'] = "enabled";

	ob_flush();

	flush();

	if (!$input_errors) {

			$restart_webgui = true;

		if (update_if_changed("webgui port", $config['system']['webgui']['port'], $_POST['webguiport']))

			$restart_webgui = true;

		if (update_if_changed("webgui certificate", $config['system']['webgui']['ssl-certref'], $_POST['ssl-certref']))

			$restart_webgui = true;

		} else {

		}

			$config['system']['disableconsolemenu'] = true;

			unset($config['system']['disableconsolemenu']);

		if ($_POST['noantilockout'] == "yes")

			$config['system']['webgui']['noantilockout'] = true;

		else

			unset($config['system']['webgui']['noantilockout']);

		if ($_POST['enableserial'] == "yes")

			$config['system']['enableserial'] = true;

		else

			unset($config['system']['enableserial']);

			$config['system']['webgui']['nodnsrebindcheck'] = true;

		else

			unset($config['system']['webgui']['nodnsrebindcheck']);

			$config['system']['webgui']['althostnames'] = $_POST['althostnames'];

		else

			unset($config['system']['webgui']['althostnames']);

		if($_POST['enablesshd'])

		if ($_POST['sshport'])

			$config['system']['ssh']['port'] = $_POST['sshport'];

		if (($sshd_enabled != $config['system']['enablesshd']) ||

			($sshd_keyonly != $config['system']['sshdkeyonly']) ||

			($sshd_port != $config['system']['ssh']['port']))

			$restart_sshd = true;

		if ($restart_webgui) {

			global $_SERVER;

			list($host) = explode(":", $_SERVER['HTTP_HOST']);

			$prot = $config['system']['webgui']['protocol'];

			$port = $config['system']['webgui']['port'];

			if ($port)

				$url = "{$prot}://{$host}:{$port}/system_advanced_admin.php";

			else

		write_config();

		$retval = filter_configure();

		setup_serial_port();

		conf_mount_ro();

	}

}

?>

<body link="#0000CC" vlink="#0000CC" alink="#0000CC">

<script language="JavaScript">

<!--

function prot_change() {

	if (document.iform.https_proto.checked)

		document.getElementById("ssl_opts").style.display="";

	else

		document.getElementById("ssl_opts").style.display="none";

}

//-->

</script>

	if ($input_errors)

		print_input_errors($input_errors);

	if ($savemsg)

		print_info_box($savemsg);

?>

		<table width="100%" border="0" cellpadding="0" cellspacing="0">

			<tr>

				<td>

					<?php

						$tab_array = array();

						$tab_array[] = array(gettext("Firewall / NAT"), false, "system_advanced_firewall.php");

						$tab_array[] = array(gettext("Networking"), false, "system_advanced_network.php");

						$tab_array[] = array(gettext("Miscellaneous"), false, "system_advanced_misc.php");

						$tab_array[] = array(gettext("System Tunables"), false, "system_advanced_sysctl.php");

						$tab_array[] = array(gettext("Notifications"), false, "system_advanced_notifications.php");

					?>

				</td>

			</tr>

			<tr>

					<div class="tabcont">

						<span class="vexpl">

							<span class="red">

						</span>

						<br/>

						<table width="100%" border="0" cellpadding="6" cellspacing="0">

							<tr>

											$http_chk = "checked";

										if ($pconfig['webguiproto'] == "https")

											$https_chk = "checked";

										if (!$certs_available)

											$https_disabled = "disabled";

									<input name="webguiproto" id="https_proto" type="radio" value="https" <?=$https_chk;?> <?=$https_disabled;?> onClick="prot_change()">

									<br/>

									<a href="system_certmanager.php"><?=gettext("Create or Import"); ?></a>

									<?=gettext("a Certificate before SSL can be enabled."); ?>

								</td>

							</tr>

							<tr id="ssl_opts">

									<select name="ssl-certref" id="ssl-certref" class="formselect">

										<?php

											foreach($a_cert as $cert):

												$selected = "";

												if ($pconfig['ssl-certref'] == $cert['refid'])

													$selected = "selected";

										?>

										<option value="<?=$cert['refid'];?>"<?=$selected;?>><?=$cert['name'];?></option>

										<?php endforeach; ?>

									</select>

								</td>

							</tr>

							<tr>

									<input name="webguiport" type="text" class="formfld unknown" id="webguiport" "size="5" value="<?=htmlspecialchars($config['system']['webgui']['port']);?>">

									<br>

									<span class="vexpl">

										"above if you want to override the default (80 for HTTP, 443 " .

										"for HTTPS). Changes will take effect immediately after save."); ?>

								</td>

							</tr>

								<td width="22%" valign="top" class="vncell"><?=gettext("WebGUI redirect"); ?></td>

								<td width="78%" class="vtable">

									<input name="disablehttpredirect" type="checkbox" id="disablehttpredirect" value="yes" <?php if ($pconfig['disablehttpredirect']) echo "checked"; ?> />

									<strong><?=gettext("Disable webConfigurator redirect rule"); ?></strong>

									<br/>

									<?php gettext("When this is unchecked, access to the webConfigurator " .

									"is always permitted even on port 80, regardless of the listening port configured." .

									"Check this box to disable this automatically added redirect rule. ");

									?>

								</td>

							</tr>

									<?php

										if($config['interfaces']['lan']) 

											$lockout_interface = "LAN";

										else 

											$lockout_interface = "WAN";

									?>

									<input name="noantilockout" type="checkbox" id="noantilockout" value="yes" <?php if ($pconfig['noantilockout']) echo "checked"; ?> />

									"on the %s interface is always permitted, regardless of the user-defined firewall " .

									"rule set. Check this box to disable this automatically added rule, so access " .

									"to the webConfigurator is controlled by the user-defined firewall rules " .

									"(ensure you have a firewall rule in place that allows you in, or you will " .

									"lock yourself out!)"), $lockout_interface); ?>

									<em> <?=gettext("Hint: the &quot;Set interface(s) IP address&quot; option in the console menu resets this setting as well."); ?> </em>

							</tr>

								<td width="22%" valign="top" class="vncell"><?=gettext("DNS Rebind Check"); ?></td>

								<td width="78%" class="vtable">

									<input name="nodnsrebindcheck" type="checkbox" id="nodnsrebindcheck" value="yes" <?php if ($pconfig['nodnsrebindcheck']) echo "checked"; ?> />

									<strong><?=gettext("Disable webConfigurator DNS Rebinding Checks"); ?></strong>

									<br/>

									<?php echo gettext("When this is unchecked, access to the webConfigurator " .

									"is protected against <a href=\"http://en.wikipedia.org/wiki/DNS_rebinding\">DNS Rebinding attacks</a>. " .

									"Check this box to disable this protection if you find that it interferes with " .

									"webConfigurator access in certain corner cases. "); ?>

								</td>

							</tr>

								<td width="22%" valign="top" class="vncell"><?=gettext("Alternate Hostnames"); ?></td>

								<td width="78%" class="vtable">

									<input name="althostnames" type="text" class="formfld unknown" id="althostnames" size="75" value="<?=htmlspecialchars($pconfig['althostnames']);?>"/>

									<br/>

									<strong><?=gettext("Alternate Hostnames for DNS Rebinding Checks"); ?></strong>

									<br/>

									<?php echo gettext("Here you can specify alternate hostnames by which the router may be queried, to " . 

									"bypass the DNS Rebinding Attack checks. Separate hostnames with spaces."); ?>

								</td>

							</tr>

								<td colspan="2" class="list" height="12">&nbsp;</td>

							</tr>

							<tr>

							<tr>

									<input name="enablesshd" type="checkbox" id="enablesshd" value="yes" <?php if (isset($pconfig['enablesshd'])) echo "checked"; ?> />

							</tr>

							<tr>

							</tr>

							<tr>

									<input name="sshport" type="text" id="sshport" value="<?php echo $pconfig['sshport']; ?>" />

									<br/>

							</tr>

							<tr>

								<td colspan="2" class="list" height="12">&nbsp;</td>

							</tr>

							<?php if($g['platform'] == "pfSense" || $g['platform'] == "cdrom"): ?>

							<tr>

							<tr>

									<input name="enableserial" type="checkbox" id="enableserial" value="yes" <?php if (isset($pconfig['enableserial'])) echo "checked"; ?> />

							</tr>

							<tr>

								<td colspan="2" class="list" height="12">&nbsp;</td>

							</tr>

							<?php endif; ?>

							<tr>

							<tr>

									<input name="disableconsolemenu" type="checkbox" id="disableconsolemenu" value="yes" <?php if ($pconfig['disableconsolemenu']) echo "checked"; ?>  />

							</tr>

							<tr>

							</tr>							

							<tr>

							<tr>

								<td colspan="2" class="list" height="12">&nbsp;</td>

							</tr>

						</table>

					</div>

				</td>

			</tr>

		</table>

	</form>

	<!--

		prot_change();

	//-->

	</script>

<?php include("fend.inc"); ?>

	if ($restart_webgui)

</html>

<?php

	if ($config['system']['enablesshd']) {

}

	ob_flush();

	flush();

}