configuration du dossier racine du serveur web n'est pas sécurisée

RoseT · 2024-02-16 12:18:39

Bonjour
j'ai ce problème depuis que j'ai mis a jour mon glpi ( de 10.0.2 à 10.0.12 )

J'ai le message "La configuration du dossier racine du serveur web n'est pas sécurisée car elle permet l'accès à des fichiers non publics. Référez-vous à la documentation d'installation pour plus de détails."

donc j'ai tenté de régler le problème en modifiant mon glpi.conf dans /etc/apache2/sites-available en rajoutant ce qui est donné dans la doc :

<VirtualHost *:80>
# The ServerName directive sets the request scheme, hostname and port that
# the server uses to identify itself. This is used when creating
# redirection URLs. In the context of virtual hosts, the ServerName
# specifies what hostname must appear in the request's Host: header to
# match this virtual host. For the default virtual host (this file) this
# value is not decisive as it is used as a last resort host regardless.
# However, you must set it for any further virtual host explicitly.
ServerName serveur. fr
ServerAlias www. serveur.fr
ServerAdmin webmaster@localhost
DocumentRoot /var/www/glpi

<Directory /var/www/glpi/public>
Require all granted

RewriteEngine On

# Ensure authorization headers are passed to PHP.
# Some Apache configurations may filter them and break usage of API, CalDAV, ...
RewriteCond %{HTTP:Authorization} ^(.+)$
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

# Redirect all requests to GLPI router, unless file exists.
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.*)$ index.php [QSA,L]
</Directory>

# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
# error, crit, alert, emerg.
# It is also possible to configure the loglevel for particular
# modules, e.g.
#LogLevel info ssl:warn

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined

# For most configuration files from conf-available/, which are
# enabled or disabled at a global level, it is possible to
# include a line for only one particular virtual host. For example the
# following line enables the CGI configuration for this host only
# after it has been globally disabled with "a2disconf".
#Include conf-available/serve-cgi-bin.conf

Redirect permanent / https:// glpi.serveur.fr/

</VirtualHost>

<VirtualHost *:443>
# The ServerName directive sets the request scheme, hostname and port that
# the server uses to identify itself. This is used when creating
# redirection URLs. In the context of virtual hosts, the ServerName
# specifies what hostname must appear in the request's Host: header to
# match this virtual host. For the default virtual host (this file) this
# value is not decisive as it is used as a last resort host regardless.
# However, you must set it for any further virtual host explicitly.
ServerName serveur .fr
ServerAlias www .serveur.fr
ServerAdmin webmaster@localhost
DocumentRoot /var/www/glpi

<Directory /var/www/glpi/public>
Require all granted

RewriteEngine On

# Ensure authorization headers are passed to PHP.
# Some Apache configurations may filter them and break usage of API, CalDAV, ...
RewriteCond %{HTTP:Authorization} ^(.+)$
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

# Redirect all requests to GLPI router, unless file exists.
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.*)$ index.php [QSA,L]
</Directory>

# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
# error, crit, alert, emerg.
# It is also possible to configure the loglevel for particular
# modules, e.g.
#LogLevel info ssl:warn

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined

# For most configuration files from conf-available/, which are
# enabled or disabled at a global level, it is possible to
# include a line for only one particular virtual host. For example the
# following line enables the CGI configuration for this host only
# after it has been globally disabled with "a2disconf".
#Include conf-available/serve-cgi-bin.conf

SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/serveur/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/serveur/privkey.pem

</VirtualHost>

mais apache n'aprécit pas trop et renvoie cette erreur quand je le restart
Job for apache2.service failed because the control process exited with error code.
See "systemctl status apache2.service" and "journalctl -xeu apache2.service" for details. ( j'ai pas les logs car je l'ai restart avec l'ancienne version )

donc je suis revenu à l'ancienne version
si quelqu’un connais une solution il est bien venu, merci d'avence

cconard96 · 2024-02-17 01:56:38

À première vue,

Il semble que DocumentRoot ne soit pas correct. Il doit pointer vers "/var/www/glpi/public".

Pour vérifier la syntaxe globale de la configuration, ce qui peut entraîner l'échec du service, utilisez "apachectl configtest"

http://httpd.apache.org/docs/2.2/progra … hectl.html

Chico008 · 2024-02-19 16:52:57

autre chose, passer la commande indiqué : journalctl -xeu apache2.service aurait justement afficher plus precisement ce qui bloque

par contre, comment accedes tu a ton glpi ?
via un nom dns ? https://glpi.domaine.net (par exemple)
ou via un alias ? https://serveur/glpi

autre point, si tu fait une redirection du http vers https, tu peut reduire ton virtualhost *:80 au simple redirect permanent

<VirtualHost *:80>
     servername glpi.serveur.fr
     Redirect permanent / https://glpi.serveur.fr/
</VirtualHost>

Last edited by Chico008 (2024-02-19 16:53:56)

Forum GLPI-Project

Announcement

#1 2024-02-16 12:18:39

configuration du dossier racine du serveur web n'est pas sécurisée

#2 2024-02-17 01:56:38

Re: configuration du dossier racine du serveur web n'est pas sécurisée

#3 2024-02-19 16:52:57

Re: configuration du dossier racine du serveur web n'est pas sécurisée

Board footer