Improve security warnings

Matthew Holt committed Feb 16, 2021 at 13:31 UTC fbd00e4b53226164a9aae5f44bd52328d4e59d96

2 files changed +14 -3

modules/caddyhttp/app.go

+2 -3

@@ -176,8 +176,8 @@ func (app *App) Provision(ctx caddy.Context) error {

176 // domain fronting is desired and access is not restricted

177 // based on hostname

178 if srv.StrictSNIHost == nil && srv.hasTLSClientAuth() {

179 - app.logger.Info("enabling strict SNI-Host matching because TLS client auth is configured",

180 - zap.String("server_name", srvName),

179 + app.logger.Warn("enabling strict SNI-Host enforcement because TLS client auth is configured",

180 + zap.String("server_id", srvName),

181 )

182 trueBool := true

183 srv.StrictSNIHost = &trueBool

@@ -283,7 +283,6 @@ func (app *App) Validate() error {

283 }

284 }

285 }

286 -

286 return nil

287 }

288

modules/caddytls/tls.go

+12

@@ -236,6 +236,18 @@ func (t *TLS) Validate() error {

236

237 // Start activates the TLS module.

238 func (t *TLS) Start() error {

239 + // warn if on-demand TLS is enabled but no restrictions are in place

240 + if t.Automation.OnDemand == nil ||

241 + (t.Automation.OnDemand.Ask == "" && t.Automation.OnDemand.RateLimit == nil) {

242 + for _, ap := range t.Automation.Policies {

243 + if ap.OnDemand {

244 + t.logger.Warn("YOUR SERVER MAY BE VULNERABLE TO ABUSE: on-demand TLS is enabled, but no protections are in place",

245 + zap.String("docs", "https://caddyserver.com/docs/automatic-https#on-demand-tls"))

246 + break

247 + }

248 + }

249 + }

250 +

251 // now that we are running, and all manual certificates have

252 // been loaded, time to load the automated/managed certificates

253 err := t.Manage(t.automateNames)