owncloud 9 и https

subalk · Aug 1, 2018

сервер FreeNAS-11.1-U5 на нём поднят owncloud 9 в Jail`e. Подскажите как в owncloud сделать защищенное соединение пользователей (https)?
Подключение по https к рутовой части FreeNAS-11.1-U5 разобрался как организовать через "центр сертификатов".... но как сделать в owncloud 9 пока понять не могу :(

chs · Aug 2, 2018

Ну думаю как в обычном owncloud -

Получаете/генерируете сертификат
Устанавливаете его на web-сервер
Настраиваете web-сервер на работу по https

Так как это jail (ну почти виртуальная машина :) ) делать это надо средствами owncloud (если они есть) или из командной строки jail-а

Чтоб попасть в консоль jail то надо подключится к консоли FreeNAS и с помощью jls и jexec попасть внутрь нужного jail-а

У меня это выглядит примерно так -

 

# jls

  JID  IP Address  Hostname  Path

  2  glusterfs  /mnt/jails/glusterfs

# jexec 2 tcsh

root@glusterfs:/ #

subalk · Aug 2, 2018

спс за ответ... да я примерно так все и делал... мб чего-то не хватает?

Code:

[root@freenas ~]#jls																												
   JID  IP Address	  Hostname					  Path																		 
	 1				  owncloud_1					/mnt/Raid1/jails/owncloud_1												   
[root@freenas ~]# jexec 1 tcsh																									 
root@owncloud_1:/ # cd /usr/pbi/owncloud-amd64/etc/apache24/																		
root@owncloud_1:/usr/pbi/owncloud-amd64/etc/apache24 # ls -l																		
total 65																															
drwxr-xr-x  2 root  wheel	  3 Jul 30 10:03 envvars.d																			 
drwxr-xr-x  2 root  wheel	 14 Nov 12  2016 extra																				 
-rw-r--r--  1 root  wheel  19543 Jul 30 10:03 httpd.conf																			
drwxr-xr-x  2 root  wheel	  4 Jul 30 10:03 Includes																			 
-rw-r--r--  1 root  wheel  13077 Nov 12  2016 magic																				 
-rw-r--r--  1 root  wheel  53011 Nov 12  2016 mime.types																			
drwxr-xr-x  2 root  wheel	  3 Nov 12  2016 modules.d																			 
drwxr-xr-x  2 root  wheel	  5 Aug  2 09:37 old																				   
-rw-r--r--  1 root  wheel   1318 Aug  1 19:37 owncloud.crt																		 
-rw-r--r--  1 root  wheel   1704 Aug  1 19:37 owncloud.key

старые ключи у брал в папочку old и создал новые ключи так...

Code:

openssl req -new -x509 -days 3650 -nodes -out owncloud.crt -keyout owncloud.key

в конфиге прописал пути

Code:

root@owncloud_1:/usr/pbi/owncloud-amd64/etc/apache24 # ee /usr/pbi/owncloud-amd64/etc/apache24/extra/httpd-ssl.conf 

SSLEngine on																														
SSLCertificateFile "/usr/pbi/owncloud-amd64/etc/apache24/owncloud.crt"															 
SSLCertificateKeyFile "/usr/pbi/owncloud-amd64/etc/apache24/owncloud.key"

subalk · Aug 2, 2018

увидал на этом же форуме тему по такой же проблеме https://forums.freenas.org/index.php?threads/owncloud-ssl-self-signed-certs.15187/ вроде бы сделал как описано но нечего не вышло... статейка 2013 года мб устарела...

chs · Aug 2, 2018

Ну в той статье про apache 2.2 у Вас 2.4 - но не думаю что большая разница.

В чём проблема-то ?
Что в логах апача после #service apache24 restart ?

P.S. Тут уж надо искать проблему в настройке ssl-apache, а не owncloud-FreeNAS

subalk · Aug 2, 2018

проблема в том что не могу сделать нормальное подключение через https https://ibb.co/geJqdz

в логах
root@owncloud_1:/ # tail -n 50 /var/log/httpd-error.log

Code:

[Thu Aug 02 13:27:15.706690 2018] [mpm_prefork:notice] [pid 5007] AH00169: caught SIGTERM, shutting down							
[Thu Aug 02 13:27:15.785882 2018] [ssl:warn] [pid 14744] AH01906: 127.0.0.1:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)																											
[Thu Aug 02 13:27:15.786008 2018] [ssl:warn] [pid 14744] AH01909: 127.0.0.1:443:0 server certificate does NOT include an ID which matches the server name																											 
[Thu Aug 02 13:27:15.802819 2018] [ssl:warn] [pid 14745] AH01906: 127.0.0.1:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)																											
[Thu Aug 02 13:27:15.802836 2018] [ssl:warn] [pid 14745] AH01909: 127.0.0.1:443:0 server certificate does NOT include an ID which matches the server name																											 
[Thu Aug 02 13:27:15.892500 2018] [mpm_prefork:notice] [pid 14745] AH00163: Apache/2.4.10 (FreeBSD) OpenSSL/0.9.8zh-freebsd PHP/5.5.16 configured -- resuming normal operations																						
[Thu Aug 02 13:27:15.892525 2018] [core:notice] [pid 14745] AH00094: Command line: '/usr/pbi/owncloud-amd64/sbin/httpd -D NOHTTPACCEPT'

chs · Aug 2, 2018

subalk said:
проблема в том что не могу сделать нормальное подключение через https https://ibb.co/geJqdz

в логах
root@owncloud_1:/ # tail -n 50 /var/log/httpd-error.log

Code:
[Thu Aug 02 13:27:15.785882 2018] [ssl:warn] [pid 14744] AH01906: 127.0.0.1:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)

А чего веб сервер у Вас на localhost (AH01906: 127.0.0.1:443) настроен ?

subalk · Aug 2, 2018

)) да в логах увидел тоже удивился.. )) я конечно не селен в Unix подобных системах но пытаюсь разбираться...

отредактировал
root@owncloud_1:/ # ee /etc/hosts

Code:

#::1					 localhost localhost.localdomain																			
#127.0.0.1			   localhost localhost.localdomain owncloud_1																 
172.29.25.3					 owncloud_1

в логах стало

Code:

[Thu Aug 02 16:56:54.693456 2018] [mpm_prefork:notice] [pid 23678] AH00169: caught SIGTERM, shutting down						   
[Thu Aug 02 16:56:54.771541 2018] [ssl:warn] [pid 23961] AH01906: 172.29.25.3:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?) 
[Thu Aug 02 16:56:54.771631 2018] [ssl:warn] [pid 23961] AH01909: 172.29.25.3:443:0 server certificate does NOT include an ID which matches the server name	
[Thu Aug 02 16:56:54.784319 2018] [ssl:warn] [pid 23962] AH01906: 172.29.25.3:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)	
[Thu Aug 02 16:56:54.784335 2018] [ssl:warn] [pid 23962] AH01909: 172.29.25.3:443:0 server certificate does NOT include an ID which matches the server name   
[Thu Aug 02 16:56:54.882636 2018] [mpm_prefork:notice] [pid 23962] AH00163: Apache/2.4.10 (FreeBSD) OpenSSL/0.9.8zh-freebsd PHP/5.5.16 configured -- resuming normal operations 
[Thu Aug 02 16:56:54.882673 2018] [core:notice] [pid 23962] AH00094: Command line: '/usr/pbi/owncloud-amd64/sbin/httpd -D NOHTTPACCEPT'

chs · Aug 2, 2018

И что на https://172.29.25.3 с клиента выдаёт ?

Ну и заодно строчки из httpd-accsses.log - для подключения

subalk · Aug 2, 2018

хром выдает при подключение по https что не защищено... https://ibb.co/fAY6Le

логи httpd-accsses.log

Code:

172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/img/actions/logout.svg HTTP/1.1" 200 1089								 
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/img/places/files.svg HTTP/1.1" 200 655									 
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /apps/activity/img/activity.svg HTTP/1.1" 200 499								
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /apps/gallery/img/app.svg HTTP/1.1" 200 692									 
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /settings/img/apps.svg HTTP/1.1" 200 344										 
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/img/actions/delete.svg HTTP/1.1" 200 478								   
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/img/breadcrumb.svg HTTP/1.1" 200 455									   
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/img/actions/settings.svg HTTP/1.1" 200 1696								
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /apps/files/img/delete.svg HTTP/1.1" 200 478									 
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /apps/files/img/external.svg HTTP/1.1" 200 608								   
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /apps/systemtags/img/tag.svg HTTP/1.1" 200 813								   
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /apps/files/img/share.svg HTTP/1.1" 200 1003									 
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /apps/files/img/star.svg HTTP/1.1" 200 541									   
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /apps/files/img/folder.svg HTTP/1.1" 200 632									 
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/img/actions/search-white.svg HTTP/1.1" 200 812							 
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/fonts/OpenSans-Regular.woff HTTP/1.1" 200 20544							
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/img/logo-icon.svg HTTP/1.1" 200 2910									   
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/fonts/OpenSans-Light.woff HTTP/1.1" 200 62844							 
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/img/actions/menu.svg HTTP/1.1" 200 335									 
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/search/templates/part.results.html HTTP/1.1" 200 208					   
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /apps/notifications/img/notifications.svg HTTP/1.1" 200 578					 
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/img/actions/toggle-pictures.svg HTTP/1.1" 200 557						 
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/img/breadcrumb.svg HTTP/1.1" 200 455									   
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/fonts/OpenSans-Semibold.woff HTTP/1.1" 200 69888						   
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /ocs/v2.php/apps/notifications/api/v1/notifications?format=json HTTP/1.1" 200 541
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/img/loading.gif HTTP/1.1" 200 2319										 
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/img/actions/close.svg HTTP/1.1" 200 881									
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/img/places/home.svg HTTP/1.1" 200 506									 
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /apps/notifications/img/notifications-new.svg HTTP/1.1" 200 767				 
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "PROPFIND /remote.php/webdav/ HTTP/1.1" 207 4142									 
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/img/actions/add.svg HTTP/1.1" 200 543									 
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /apps/gallery/config?extramediatypes=1 HTTP/1.1" 200 102						 
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /avatar/admin/28 HTTP/1.1" 200 32												
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/img/actions/more.svg HTTP/1.1" 200 660									 
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/img/filetypes/application-pdf.svg HTTP/1.1" 200 2403					   
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/img/actions/share.svg HTTP/1.1" 200 1003								   
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/img/actions/star.svg HTTP/1.1" 200 554									 
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/img/filetypes/folder.svg HTTP/1.1" 200 662								 
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/img/actions/triangle-s.svg HTTP/1.1" 200 395							   
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/img/actions/triangle-n.svg HTTP/1.1" 200 397							   
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/img/actions/checkbox.svg HTTP/1.1" 200 479								 
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/img/filetypes/folder-external.svg HTTP/1.1" 200 826						
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /index.php/apps/files/ajax/getstoragestats.php?dir=%2F HTTP/1.1" 200 277		 
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /ocs/v1.php/apps/files_external/api/v1/mounts?format=json HTTP/1.1" 200 235	 
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /avatar/admin/28 HTTP/1.1" 200 32												
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /core/preview.png?file=%2FownCloud+Manual.pdf&c=8b68e9618f1b2a06bb0f6edea496b2b1&x=32&y=32&forceIcon=0 HTTP/1.1" 404 -	 
172.29.25.76 - - [03/Aug/2018:09:06:18 +0300] "GET /index.php/apps/files_external/userglobalstorages/2?testOnly=false HTTP/1.1" 200 235

httpd-error.log

Code:

[Thu Aug 02 13:27:15.706690 2018] [mpm_prefork:notice] [pid 5007] AH00169: caught SIGTERM, shutting down							
[Thu Aug 02 13:27:15.785882 2018] [ssl:warn] [pid 14744] AH01906: 127.0.0.1:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Thu Aug 02 13:27:15.786008 2018] [ssl:warn] [pid 14744] AH01909: 127.0.0.1:443:0 server certificate does NOT include an ID which matches the server name 
[Thu Aug 02 13:27:15.802819 2018] [ssl:warn] [pid 14745] AH01906: 127.0.0.1:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Thu Aug 02 13:27:15.802836 2018] [ssl:warn] [pid 14745] AH01909: 127.0.0.1:443:0 server certificate does NOT include an ID which matches the server name
[Thu Aug 02 13:27:15.892500 2018] [mpm_prefork:notice] [pid 14745] AH00163: Apache/2.4.10 (FreeBSD) OpenSSL/0.9.8zh-freebsd PHP/5.5.16 configured -- resuming normal
[Thu Aug 02 13:27:15.892525 2018] [core:notice] [pid 14745] AH00094: Command line: '/usr/pbi/owncloud-amd64/sbin/httpd -D NOHTTPACCEPT' 
[Thu Aug 02 16:54:27.761862 2018] [mpm_prefork:notice] [pid 14745] AH00169: caught SIGTERM, shutting down						   
[Thu Aug 02 16:54:27.840028 2018] [ssl:warn] [pid 23677] AH01906: 127.0.0.1:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Thu Aug 02 16:54:27.840117 2018] [ssl:warn] [pid 23677] AH01909: 127.0.0.1:443:0 server certificate does NOT include an ID which matches the server name
[Thu Aug 02 16:54:27.852727 2018] [ssl:warn] [pid 23678] AH01906: 127.0.0.1:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Thu Aug 02 16:54:27.852743 2018] [ssl:warn] [pid 23678] AH01909: 127.0.0.1:443:0 server certificate does NOT include an ID which matches the server name 
[Thu Aug 02 16:54:27.944664 2018] [mpm_prefork:notice] [pid 23678] AH00163: Apache/2.4.10 (FreeBSD) OpenSSL/0.9.8zh-freebsd PHP/5.5.16 configured -- resuming normal
[Thu Aug 02 16:54:27.944702 2018] [core:notice] [pid 23678] AH00094: Command line: '/usr/pbi/owncloud-amd64/sbin/httpd -D NOHTTPACCEPT'
[Thu Aug 02 16:56:54.693456 2018] [mpm_prefork:notice] [pid 23678] AH00169: caught SIGTERM, shutting down						   
[Thu Aug 02 16:56:54.771541 2018] [ssl:warn] [pid 23961] AH01906: 172.29.25.3:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Thu Aug 02 16:56:54.771631 2018] [ssl:warn] [pid 23961] AH01909: 172.29.25.3:443:0 server certificate does NOT include an ID which matches the server name 
[Thu Aug 02 16:56:54.784319 2018] [ssl:warn] [pid 23962] AH01906: 172.29.25.3:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Thu Aug 02 16:56:54.784335 2018] [ssl:warn] [pid 23962] AH01909: 172.29.25.3:443:0 server certificate does NOT include an ID which matches the server name
[Thu Aug 02 16:56:54.882636 2018] [mpm_prefork:notice] [pid 23962] AH00163: Apache/2.4.10 (FreeBSD) OpenSSL/0.9.8zh-freebsd PHP/5.5.16 configured -- resuming normal
[Thu Aug 02 16:56:54.882673 2018] [core:notice] [pid 23962] AH00094: Command line: '/usr/pbi/owncloud-amd64/sbin/httpd -D NOHTTPACCEPT'

chs · Aug 3, 2018

Ну значит резюме :)

сервер по https работает. Проблема в сертификате. Прям написано - что нет Вашему сертификату доверия :)
Отсюда или Вы помещаете свой сертификат в хранилище доверенных, или покупаете сертификат или берёте бесплатный.

В общем RTFM по сертификатам. А так всё у Вас настроено и работает.

subalk · Aug 3, 2018

да... я сертификат пробовал уже заносить в доверенную зону но всеравно пишет что соединение не защищено... https://ibb.co/dthSRK

chs · Aug 3, 2018

Ну а ткнуться в "не защищено" и посмотреть что там ?

subalk · Aug 3, 2018

да там нечего толкового...

chs · Aug 3, 2018

Ну значит проблема в сертификате. Тут я не помощник.

subalk · Aug 3, 2018

да я вот понять не могу в какую сторону смотреть... Freenas работает на Nginx, а OwnCloud уже на Apache24... мб вообще не там копаю.. ))

subalk · Aug 3, 2018

Замучил я OwnCloud джаил вообще отвалился :) и больше не появляется в FreeNAS... наверное буду пробовать ставить по этой статейке https://habr.com/post/255019/

Important Announcement for the TrueNAS Community.

owncloud 9 и https

subalk

Dabbler

chs

Guru

subalk

Dabbler

subalk

Dabbler

chs

Guru

subalk

Dabbler

chs

Guru

subalk

Dabbler

chs

Guru

subalk

Dabbler

chs

Guru

subalk

Dabbler

chs

Guru

subalk

Dabbler

chs

Guru

subalk

Dabbler

subalk

Dabbler

Similar threads

Important Announcement for the TrueNAS Community.

owncloud 9 и https

Dabbler

Guru

Dabbler

Dabbler

Guru

Dabbler

Guru

Dabbler

Guru

Dabbler

Guru

Dabbler

Guru

Dabbler

Guru

Dabbler

Dabbler

Important Announcement for the TrueNAS Community.

Related topics on forums.truenas.com for thread: "owncloud 9 и https"

Similar threads