Initial commit: VPS tutorial complet (105 etapes)

2026-04-08 16:15:11 +02:00
commit acbe11489c
18 changed files with 1848 additions and 0 deletions
--- a/13-securite.md
+++ b/13-securite.md
@@ -0,0 +1,122 @@
+# 13. Securite
+
+## Certificats Let's Encrypt pour les outils
+
+### ISPConfig
+
+Les certificats sont dans `/var/www/clients/clientX/webY/ssl/<DOMAINE>-le.crt` et `.key`.
+
+```bash
+SSL_DIR="/var/www/clients/client1/web7/ssl"
+ISP_SSL="/usr/local/ispconfig/interface/ssl"
+
+cp $SSL_DIR/<DOMAINE>-le.crt $ISP_SSL/ispserver.crt
+cp $SSL_DIR/<DOMAINE>-le.key $ISP_SSL/ispserver.key
+
+# Creer PEM (cert + key)
+cat $ISP_SSL/ispserver.crt $ISP_SSL/ispserver.key > $ISP_SSL/ispserver.pem
+
+systemctl restart apache2
+```
+
+### Postfix / Dovecot
+
+Les certificats sont automatiquement utilises via le PEM ISPConfig. Pour le SNI multi-domaines, voir [08-sni-mail.md](08-sni-mail.md).
+
+## phpMyAdmin securise
+
+### Changer l'URL et ajouter HTTP Auth
+
+1. Desactiver l'alias global :
+```bash
+a2disconf phpmyadmin
+```
+
+2. DNS A `dbmanage` -> `<IP>`
+3. Sous-domaine ISPConfig `dbmanage.<DOMAINE>` (SSL, LE, PHP-FPM, HTTPS redirect)
+4. Apache Directives :
+
+```apache
+Alias / /usr/share/phpmyadmin/
+
+<Directory /usr/share/phpmyadmin>
+    Options SymLinksIfOwnerMatch
+    DirectoryIndex index.php
+
+    AuthType Basic
+    AuthName "Database Management - Restricted Access"
+    AuthUserFile /etc/phpmyadmin/htpasswd.setup
+    Require valid-user
+
+    <IfModule mod_php.c>
+        php_admin_value upload_tmp_dir /var/lib/phpmyadmin/tmp
+        php_admin_value open_basedir /usr/share/phpmyadmin/:/etc/phpmyadmin/:/var/lib/phpmyadmin/:/usr/share/php/:/usr/share/javascript/
+    </IfModule>
+</Directory>
+
+<Directory /usr/share/phpmyadmin/setup>
+    Require all denied
+</Directory>
+
+<Directory /usr/share/phpmyadmin/libraries>
+    Require all denied
+</Directory>
+
+<Directory /usr/share/phpmyadmin/templates>
+    Require all denied
+</Directory>
+```
+
+5. Creer le mot de passe HTTP Auth :
+```bash
+htpasswd -c /etc/phpmyadmin/htpasswd.setup admin
+```
+
+### Fail2ban pour phpMyAdmin
+
+Creer `/etc/fail2ban/filter.d/phpmyadmin.conf` :
+```
+[Definition]
+failregex = ^<HOST> -.*"(GET|POST).*/dbmanage.*
+            user denied.*client: <HOST>
+ignoreregex =
+```
+
+Creer `/etc/fail2ban/jail.d/phpmyadmin.conf` :
+```
+[phpmyadmin]
+enabled = true
+port = http,https
+filter = phpmyadmin
+logpath = /var/log/apache2/access.log
+maxretry = 5
+bantime = 3600
+findtime = 600
+```
+
+```bash
+systemctl restart fail2ban
+```
+
+### Creer un admin DB
+
+```bash
+mysql -u root -e "CREATE USER 'dbadmin'@'localhost' IDENTIFIED BY '<MOT_DE_PASSE>'; GRANT ALL PRIVILEGES ON *.* TO 'dbadmin'@'localhost' WITH GRANT OPTION; FLUSH PRIVILEGES;"
+```
+
+## DNSSEC
+
+### Activer dans ISPConfig
+
+DNS > Zones > `<DOMAINE>` > Zone settings > Sign Zone (DNSSEC) > Save
+
+Recuperer les DS-Data affiches.
+
+### Ajouter chez le registrar
+
+**OVH :** DS Records > Ajouter
+- Key tag, Algorithm 13, Digest type 2 (SHA-256), Digest
+
+> **Piege OVH :** OVH peut retourner "Error while checking DNSKEYS" avec des NS personnalises. Retenter ou contacter le support.
+
+**MTN (.ci) :** Envoyer les DS records au support car l'interface bug.