🎉 Hinzugefügt: Vollständiges Setup-Skript für die Produktionsumgebung mit HTTPS-Only-Konfiguration, automatischer Kiosk-Start, verbesserter Firewall-Sicherheit und browser-kompatiblen SSL-Zertifikaten. 🚀🔒
This commit is contained in:
@ -1 +1,254 @@
|
||||
|
||||
# MYP Production HTTPS-Only Setup
|
||||
|
||||
## 🎯 Ziel
|
||||
- **ERR_SSL_KEY_USAGE_INCOMPATIBLE** beheben
|
||||
- Nur Port 443 (HTTPS) verwenden
|
||||
- Port 5000 (HTTP) komplett deaktivieren
|
||||
- Kiosk-Modus automatisch starten
|
||||
- Firewall: Nur Port 443 offen
|
||||
|
||||
## 🚀 Schnelle Lösung (Raspberry Pi)
|
||||
|
||||
### Automatisches Setup (Empfohlen)
|
||||
```bash
|
||||
# Ein Skript für alles:
|
||||
cd /opt/myp
|
||||
sudo ./setup_https_only.sh
|
||||
```
|
||||
|
||||
### 3. Services prüfen
|
||||
```bash
|
||||
# Status prüfen:
|
||||
sudo systemctl status myp-production
|
||||
sudo systemctl status myp-kiosk
|
||||
|
||||
# Logs anzeigen:
|
||||
sudo journalctl -u myp-production -f
|
||||
```
|
||||
|
||||
## 📋 Manuelle Schritte (falls Skripte nicht verfügbar)
|
||||
|
||||
### 1. Alte Services stoppen
|
||||
```bash
|
||||
sudo systemctl stop myp-https myp-app myp-kiosk
|
||||
sudo systemctl disable myp-https myp-app
|
||||
```
|
||||
|
||||
### 2. Browser-kompatible SSL-Zertifikate erstellen
|
||||
```bash
|
||||
# SSL-Verzeichnis erstellen
|
||||
sudo mkdir -p /opt/myp/ssl
|
||||
cd /opt/myp/ssl
|
||||
|
||||
# Browser-kompatible OpenSSL-Konfiguration
|
||||
sudo tee ssl.conf << 'EOF'
|
||||
[req]
|
||||
distinguished_name = req_distinguished_name
|
||||
req_extensions = v3_req
|
||||
prompt = no
|
||||
|
||||
[req_distinguished_name]
|
||||
C = DE
|
||||
ST = Baden-Wuerttemberg
|
||||
L = Stuttgart
|
||||
O = Mercedes-Benz AG
|
||||
OU = MYP Druckerverwaltung
|
||||
CN = m040tbaraspi001
|
||||
|
||||
[v3_req]
|
||||
# KRITISCH für Browser-Kompatibilität
|
||||
basicConstraints = critical, CA:FALSE
|
||||
keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement
|
||||
extendedKeyUsage = critical, serverAuth, clientAuth
|
||||
subjectAltName = critical, @alt_names
|
||||
nsCertType = server
|
||||
|
||||
[alt_names]
|
||||
DNS.1 = localhost
|
||||
DNS.2 = m040tbaraspi001
|
||||
DNS.3 = m040tbaraspi001.local
|
||||
DNS.4 = m040tbaraspi001.de040.corpintra.net
|
||||
IP.1 = 127.0.0.1
|
||||
EOF
|
||||
|
||||
# Zertifikate generieren
|
||||
sudo openssl genrsa -out key.pem 2048
|
||||
sudo openssl req -new -x509 -key key.pem -out cert.pem \
|
||||
-days 365 -config ssl.conf -extensions v3_req -sha256
|
||||
|
||||
# Berechtigungen setzen
|
||||
sudo chmod 644 cert.pem
|
||||
sudo chmod 600 key.pem
|
||||
sudo rm ssl.conf
|
||||
```
|
||||
|
||||
### 3. Production Service installieren
|
||||
```bash
|
||||
# Service-Datei kopieren
|
||||
sudo cp /opt/myp/systemd/myp-production.service /etc/systemd/system/
|
||||
|
||||
# Service aktivieren
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl enable myp-production
|
||||
sudo systemctl start myp-production
|
||||
```
|
||||
|
||||
### 4. Kiosk-Service für HTTPS aktualisieren
|
||||
```bash
|
||||
# Aktualisierte Kiosk-Service-Datei kopieren
|
||||
sudo cp /opt/myp/systemd/myp-kiosk.service /etc/systemd/system/
|
||||
|
||||
# Service neu laden und starten
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl enable myp-kiosk
|
||||
sudo systemctl start myp-kiosk
|
||||
```
|
||||
|
||||
### 5. Firewall für HTTPS-Only konfigurieren
|
||||
```bash
|
||||
# UFW installieren falls nicht vorhanden
|
||||
sudo apt update && sudo apt install -y ufw
|
||||
|
||||
# Firewall zurücksetzen
|
||||
sudo ufw --force reset
|
||||
|
||||
# Restriktive Policies
|
||||
sudo ufw default deny incoming
|
||||
sudo ufw default deny outgoing
|
||||
sudo ufw default deny forward
|
||||
|
||||
# Loopback erlauben
|
||||
sudo ufw allow in on lo
|
||||
sudo ufw allow out on lo
|
||||
|
||||
# SSH beibehalten (falls aktiv)
|
||||
sudo ufw allow 22/tcp
|
||||
|
||||
# Nur HTTPS Port 443 öffnen
|
||||
sudo ufw allow 443/tcp
|
||||
|
||||
# HTTP-Ports explizit blockieren
|
||||
sudo ufw deny 80/tcp
|
||||
sudo ufw deny 5000/tcp
|
||||
|
||||
# System-Updates erlauben
|
||||
sudo ufw allow out 53/udp # DNS
|
||||
sudo ufw allow out 80/tcp # HTTP für Updates
|
||||
sudo ufw allow out 443/tcp # HTTPS für Updates
|
||||
sudo ufw allow out 123/udp # NTP
|
||||
|
||||
# Lokales Netzwerk für Drucker
|
||||
sudo ufw allow out on eth0 to 192.168.0.0/16
|
||||
sudo ufw allow out on wlan0 to 192.168.0.0/16
|
||||
|
||||
# UFW aktivieren
|
||||
sudo ufw --force enable
|
||||
```
|
||||
|
||||
## 🔧 Problembehandlung
|
||||
|
||||
### SSL-Zertifikat-Fehler beheben
|
||||
```bash
|
||||
# SSL-Fix-Skript ausführen (falls vorhanden)
|
||||
sudo /opt/myp/fix_ssl_raspberry.sh
|
||||
|
||||
# Oder manuell neue Zertifikate erstellen (siehe oben)
|
||||
```
|
||||
|
||||
### Connection Refused beheben
|
||||
```bash
|
||||
# Quick Fix ausführen
|
||||
sudo /opt/myp/quick_fix_connection.sh
|
||||
|
||||
# Oder detaillierte Diagnose
|
||||
sudo /opt/myp/debug_connection_refused.sh
|
||||
```
|
||||
|
||||
### Service-Status prüfen
|
||||
```bash
|
||||
# Alle Services prüfen
|
||||
sudo systemctl status myp-production myp-kiosk
|
||||
|
||||
# Logs anzeigen
|
||||
sudo journalctl -u myp-production -f
|
||||
sudo journalctl -u myp-kiosk -f
|
||||
|
||||
# Port-Status prüfen
|
||||
sudo netstat -tlnp | grep :443
|
||||
sudo ss -tlnp | grep :443
|
||||
```
|
||||
|
||||
### Verbindungstest
|
||||
```bash
|
||||
# HTTPS-Verbindung testen
|
||||
curl -k -v https://localhost
|
||||
curl -k -v https://m040tbaraspi001.de040.corpintra.net
|
||||
|
||||
# Port-Erreichbarkeit testen
|
||||
timeout 5 bash -c '</dev/tcp/localhost/443' && echo "Port 443 offen"
|
||||
timeout 5 bash -c '</dev/tcp/localhost/5000' && echo "Port 5000 offen (PROBLEM!)"
|
||||
```
|
||||
|
||||
## 🌐 Zugriffs-URLs
|
||||
|
||||
Nach dem Setup ist MYP nur noch über HTTPS erreichbar:
|
||||
|
||||
- **Lokal**: https://localhost
|
||||
- **Intranet**: https://m040tbaraspi001.de040.corpintra.net
|
||||
- **Direkt**: https://[IP-Adresse]
|
||||
|
||||
## 🔐 Sicherheits-Features
|
||||
|
||||
✅ **Nur Port 443 (HTTPS) öffentlich zugänglich**
|
||||
✅ **Port 5000 (HTTP) komplett blockiert**
|
||||
✅ **Browser-kompatible SSL-Zertifikate**
|
||||
✅ **Automatischer HTTPS-Redirect**
|
||||
✅ **Sicherheits-Headers (HSTS, CSP, etc.)**
|
||||
✅ **Kiosk-Modus verwendet automatisch HTTPS**
|
||||
|
||||
## ⚠️ Wichtige Hinweise
|
||||
|
||||
1. **Browser-Zertifikat-Warnung ist normal** (Self-Signed Certificate)
|
||||
2. **HTTP-Zugriff funktioniert nicht mehr** (nur HTTPS)
|
||||
3. **Root-Berechtigung erforderlich** für Port 443
|
||||
4. **Firewall blockiert alle anderen Ports**
|
||||
5. **Kiosk startet automatisch mit HTTPS-URL**
|
||||
|
||||
## 🏁 Erfolgskontrolle
|
||||
|
||||
Nach dem Setup sollte folgendes funktionieren:
|
||||
|
||||
```bash
|
||||
# 1. Production Service läuft
|
||||
sudo systemctl is-active myp-production
|
||||
# Ausgabe: active
|
||||
|
||||
# 2. HTTPS-Port ist offen
|
||||
sudo netstat -tlnp | grep :443
|
||||
# Ausgabe: tcp 0.0.0.0:443 LISTEN
|
||||
|
||||
# 3. HTTP-Port ist geschlossen
|
||||
sudo netstat -tlnp | grep :5000
|
||||
# Ausgabe: (leer)
|
||||
|
||||
# 4. HTTPS-Webserver antwortet
|
||||
curl -k -s https://localhost | grep -i "MYP"
|
||||
# Ausgabe: HTML mit MYP-Inhalt
|
||||
|
||||
# 5. Kiosk-Service läuft (falls Display vorhanden)
|
||||
sudo systemctl is-active myp-kiosk
|
||||
# Ausgabe: active
|
||||
```
|
||||
|
||||
## 📞 Support
|
||||
|
||||
Bei Problemen:
|
||||
|
||||
1. **Logs prüfen**: `sudo journalctl -u myp-production -f`
|
||||
2. **Quick Fix**: `sudo /opt/myp/quick_fix_connection.sh`
|
||||
3. **Diagnose**: `sudo /opt/myp/debug_connection_refused.sh`
|
||||
4. **SSL-Fix**: `sudo /opt/myp/fix_ssl_raspberry.sh`
|
||||
|
||||
---
|
||||
|
||||
**🎉 Nach diesem Setup läuft MYP sicher im HTTPS-Only Modus mit browser-kompatiblen SSL-Zertifikaten!**
|
||||
Reference in New Issue
Block a user