From 8dd0a085b453b9ec087defa0a9ecb5b92fce03af Mon Sep 17 00:00:00 2001 From: Chris Koeritz Date: Sun, 17 Dec 2017 06:29:09 -0500 Subject: [PATCH] fixing strict hsts for cakelamp sites not ready yet; still in progress. --- scripts/site_avenger/revamp_cakelampvm.sh | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/scripts/site_avenger/revamp_cakelampvm.sh b/scripts/site_avenger/revamp_cakelampvm.sh index 9db5eef3..53464faf 100644 --- a/scripts/site_avenger/revamp_cakelampvm.sh +++ b/scripts/site_avenger/revamp_cakelampvm.sh @@ -136,6 +136,19 @@ fi ############## +# fix up the apache site so that HSTS is disabled. otherwise we can't view +# https site once the domain name switch has occurred. + +# we operate only on our own specialized tls conf file. hopefully no one has messed with it besides revamp. +search_replace "^[ ]*Header always set Strict-Transport-Security.*" "# not good for cakelampvm.com -- Header always set Strict-Transport-Security \"max-age=63072000; includeSubdomains;\"" /etc/apache2/conf-library/tls-enabling.conf +if [ $? -ne 0 ]; then + echo the apache tls-enabling.conf file seems to have already been patched to disable strict transport security. good. +else + echo successfully patched the apache tls-enabling.conf file to disable strict transport security. awesome. + restart_apache +fi + + ############## # sequel--tell them they're great and show the hello again also. -- 2.34.1