* Fri Dec 27 2024 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-11.sme

- add X-Content-Type-Options nosniff [SME: 12835]
- add Strict Transport Security support HSTS [SME: 12815]
- add X-Frame-Options SAMEORIGIN Header to prevent clickjacking [SME: 12816]
- add referrer-Policy same-origin [SME: 12817]
- add OCSP Stapling support [SME: 12819]
- add CSP Content-Security-Policy support [SME: 9567]
- add .well-known and .well-known/security.txt [SME: 12818]

createlinks

@@ -6,7 +6,7 @@ use esmith::Build::CreateLinks qw(:all);
 #--------------------------------------------------
 my $event = "smeserver-apache-update";
 templates2events("/etc/httpd/conf/httpd.conf", $event);
-templates2events("/var/www/html/.well-known/acme-challenge/security.txt", $event);
+templates2events("/var/www/html/.well-known/security.txt", $event);
 safe_symlink("restart", "root/etc/e-smith/events/$event/services2adjust/httpd-e-smith");
 event_link("systemd-reload", $event, "89");
 event_link("systemd-default", $event, "88");
@@ -17,7 +17,7 @@ templates2events("/etc/logrotate.d/httpd", $event);
 #--------------------------------------------------
 my $event = "console-save";
 
-templates2events("/var/www/html/.well-known/acme-challenge/security.txt", $event);
+templates2events("/var/www/html/.well-known/security.txt", $event);
 templates2events("/etc/httpd/conf/httpd.conf", $event);
 safe_symlink("restart", "root/etc/e-smith/events/$event/services2adjust/httpd-e-smith");
 
@@ -145,7 +145,7 @@ safe_symlink("reload", "root/etc/e-smith/events/$event/services2adjust/httpd-e-s
 
 $event = "remoteaccess-update";
 
-templates2events("/var/www/html/.well-known/acme-challenge/security.txt", $event);
+templates2events("/var/www/html/.well-known/security.txt", $event);
 templates2events("/etc/httpd/conf/httpd.conf", $event);
 safe_symlink("reload", "root/etc/e-smith/events/$event/services2adjust/httpd-e-smith");
 
@@ -155,7 +155,7 @@ safe_symlink("reload", "root/etc/e-smith/events/$event/services2adjust/httpd-e-s
 
 $event = "email-update";
 
-templates2events("/var/www/html/.well-known/acme-challenge/security.txt", $event);
+templates2events("/var/www/html/.well-known/security.txt", $event);
 templates2events("/etc/httpd/conf/httpd.conf", $event);
 safe_symlink("reload", "root/etc/e-smith/events/$event/services2adjust/httpd-e-smith");
 
@@ -165,7 +165,7 @@ safe_symlink("reload", "root/etc/e-smith/events/$event/services2adjust/httpd-e-s
 
 $event = "logrotate";
 
-templates2events("/var/www/html/.well-known/acme-challenge/security.txt", $event);
+templates2events("/var/www/html/.well-known/security.txt", $event);
 safe_symlink("reload", "root/etc/e-smith/events/$event/services2adjust/httpd-e-smith");
 
 #--------------------------------------------------
@@ -173,7 +173,7 @@ safe_symlink("reload", "root/etc/e-smith/events/$event/services2adjust/httpd-e-s
 #--------------------------------------------------
 
 $event = "ssl-update";
-templates2events("/var/www/html/.well-known/acme-challenge/security.txt", $event);
+templates2events("/var/www/html/.well-known/security.txt", $event);
 templates2events("/etc/httpd/conf/httpd.conf", $event);
 safe_symlink("reload", "root/etc/e-smith/events/$event/services2adjust/httpd-e-smith");
 
@@ -182,7 +182,7 @@ safe_symlink("reload", "root/etc/e-smith/events/$event/services2adjust/httpd-e-s
 #--------------------------------------------------
 
 $event = "post-install";
-templates2events("/var/www/html/.well-known/acme-challenge/security.txt", $event);
+templates2events("/var/www/html/.well-known/security.txt", $event);
 templates2events("/etc/logrotate.d/httpd", $event);
 
 #--------------------------------------------------
@@ -190,6 +190,6 @@ templates2events("/etc/logrotate.d/httpd", $event);
 #--------------------------------------------------
 
 $event = "post-upgrade";
-templates2events("/var/www/html/.well-known/acme-challenge/security.txt", $event);
+templates2events("/var/www/html/.well-known/security.txt", $event);
 templates2events("/etc/logrotate.d/httpd", $event);
 

root/etc/e-smith/templates/var/www/html/.well-known/security.txt/10contact

@@ -5,5 +5,5 @@ Contact: {
 # Contact: mailto:security%2Buri%2Bencoded@example.com
 # Contact: tel:+1-201-555-0123
 # Contact: https://example.com/security-contact.html
-${'httpd-e-smith'}{'SecurityContact'}||"mailto:admin@$DomainName"}
+${'httpd-e-smith'}{'SecurityContact'}||"mailto:admin\@$DomainName"}
 

root/usr/lib/systemd/system/httpd-e-smith.service

@@ -8,7 +8,7 @@ Documentation=man:apachectl(8)
 Type=notify
 ExecStartPre=/sbin/e-smith/service-status httpd-e-smith
 ExecStartPre=/sbin/e-smith/expand-template /etc/httpd/conf/httpd.conf
-ExecStartPre=-/sbin/e-smith/expand-template /var/www/html/.well-known/acme-challenge/security.txt
+ExecStartPre=-/sbin/e-smith/expand-template /var/www/html/.well-known/security.txt
 ExecStartPre=/sbin/e-smith/systemd/httpd-e-smith-prepare
 ExecStart=/usr/sbin/httpd -f /etc/httpd/conf/httpd.conf -DFOREGROUND
 ExecReload=/usr/sbin/httpd -f /etc/httpd/conf/httpd.conf -k graceful

smeserver-apache.spec

@@ -4,7 +4,7 @@ Summary: smeserver server and gateway - apache module
 %define name smeserver-apache
 Name: %{name}
 %define version 11.0.0
-%define release 8
+%define release 11
 Version: %{version}
 Release: %{release}%{?dist}
 License: GPL
@@ -74,7 +74,7 @@ if [ $1 -gt 1 ] ; then
 fi
 
 %changelog
-* Fri Dec 27 2024 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-8.sme
+* Fri Dec 27 2024 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-11.sme
 - add X-Content-Type-Options nosniff [SME: 12835]
 - add Strict Transport Security support HSTS [SME: 12815]
 - add X-Frame-Options SAMEORIGIN Header to prevent clickjacking [SME: 12816]