Installing collabora fails on curl

WaaromZoMoeilijk commented 7 years ago

plex.waaromzomoeilijk.nl (just a spare subdomain dont mind it)

Just ran activate-ssl.sh and rebooted, got a good cert in browser but curl complains, any idea @enoch85 ?

curl: (60) SSL certificate problem: self signed certificate
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

WaaromZoMoeilijk commented 7 years ago

root@plex:~# curl -k https://plex.waaromzomoeilijk.nl/status.php
<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
 <head>
  <title>404 - Not Found</title>
 </head>
 <body>
  <h1>404 - Not Found</h1>
 </body>
</html>

enoch85 commented 7 years ago

Do you use LE generated by the VM scripts?

WaaromZoMoeilijk commented 7 years ago

Just ran activate-ssl.sh and rebooted, got a good cert in browser but curl complains

Yes, its all good but not for curl

root@plex:~# cat /var/www/nextcloud/status.php 
<?php
/**
 * @copyright Copyright (c) 2016, ownCloud, Inc.
 *
 * @author Andreas Fischer <bantu@owncloud.com>
 * @author Christopher Schäpers <kondou@ts.unde.re>
 * @author Frank Karlitschek <frank@karlitschek.de>
 * @author Joas Schilling <coding@schilljs.com>
 * @author Jörn Friedrich Dreyer <jfd@butonic.de>
 * @author Lukas Reschke <lukas@statuscode.ch>
 * @author Masaki Kawabata Neto <masaki.kawabata@gmail.com>
 * @author Morris Jobke <hey@morrisjobke.de>
 *
 * @license AGPL-3.0
 *
 * This code is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License, version 3,
 * as published by the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU Affero General Public License for more details.
 *
 * You should have received a copy of the GNU Affero General Public License, version 3,
 * along with this program.  If not, see <http://www.gnu.org/licenses/>
 *
 */

try {

    require_once __DIR__ . '/lib/base.php';

    $systemConfig = \OC::$server->getSystemConfig();

    $installed = (bool) $systemConfig->getValue('installed', false);
    $maintenance = (bool) $systemConfig->getValue('maintenance', false);
    # see core/lib/private/legacy/defaults.php and core/themes/example/defaults.php
    # for description and defaults
    $defaults = new \OCP\Defaults();
    $values=array(
        'installed'=>$installed,
        'maintenance' => $maintenance,
        'needsDbUpgrade' => \OCP\Util::needUpgrade(),
        'version'=>implode('.', \OCP\Util::getVersion()),
        'versionstring'=>OC_Util::getVersionString(),
        'edition'=> '',
        'productname'=>$defaults->getName());
    if (OC::$CLI) {
        print_r($values);
    } else {
        header('Access-Control-Allow-Origin: *');
        header('Content-Type: application/json');
        echo json_encode($values);
    }

} catch (Exception $ex) {
    OC_Response::setStatus(OC_Response::STATUS_INTERNAL_SERVER_ERROR);
    \OCP\Util::writeLog('remote', $ex->getMessage(), \OCP\Util::FATAL);
}

A 404 on the status.php and curl complaining about self signed certs...

enoch85 commented 7 years ago

This is what I get:

root@XPS-13:~# curl -k https://plex.waaromzomoeilijk.nl/status.php
{"installed":true,"maintenance":false,"needsDbUpgrade":false,"version":"12.0.0.29","versionstring":"12.0.0","edition":"","productname":"Nextcloud"}root@XPS-13:~#

WaaromZoMoeilijk commented 7 years ago

Hang on,

A potential DNS Rebind attack has been detected.
Try to access the router by IP address instead of by hostname.

OPNsense... never mind

Using my 4G network its alright indeed. OPNsense messes with me.

enoch85 commented 7 years ago

@ezraholm50 Is that automatically, or did you configure it to block DNS rebind?

WaaromZoMoeilijk commented 7 years ago

Auto, have no clue how this stuff is resolvable. Can't test collabora on the PI untill solved.

BTW still no images show on the login page, even if i have good certs.

enoch85 commented 7 years ago

Aah ok. Was wondering since I use OPNsense as well. Great feature. :)

Hope you can solve it.

techandme / NextBerry

Installing collabora fails on curl #110