# 13. Securite

## Certificats Let's Encrypt pour les outils

### ISPConfig

Les certificats sont dans `/var/www/clients/clientX/webY/ssl/<DOMAINE>-le.crt` et `.key`.

```bash
SSL_DIR="/var/www/clients/client1/web7/ssl"
ISP_SSL="/usr/local/ispconfig/interface/ssl"

cp $SSL_DIR/<DOMAINE>-le.crt $ISP_SSL/ispserver.crt
cp $SSL_DIR/<DOMAINE>-le.key $ISP_SSL/ispserver.key

# Creer PEM (cert + key)
cat $ISP_SSL/ispserver.crt $ISP_SSL/ispserver.key > $ISP_SSL/ispserver.pem

systemctl restart apache2
```

### Postfix / Dovecot

Les certificats sont automatiquement utilises via le PEM ISPConfig. Pour le SNI multi-domaines, voir [08-sni-mail.md](08-sni-mail.md).

## phpMyAdmin securise

### Changer l'URL et ajouter HTTP Auth

1. Desactiver l'alias global :
```bash
a2disconf phpmyadmin
```

2. DNS A `dbmanage` -> `<IP>`
3. Sous-domaine ISPConfig `dbmanage.<DOMAINE>` (SSL, LE, PHP-FPM, HTTPS redirect)
4. Apache Directives :

```apache
Alias / /usr/share/phpmyadmin/

<Directory /usr/share/phpmyadmin>
    Options SymLinksIfOwnerMatch
    DirectoryIndex index.php

    AuthType Basic
    AuthName "Database Management - Restricted Access"
    AuthUserFile /etc/phpmyadmin/htpasswd.setup
    Require valid-user

    <IfModule mod_php.c>
        php_admin_value upload_tmp_dir /var/lib/phpmyadmin/tmp
        php_admin_value open_basedir /usr/share/phpmyadmin/:/etc/phpmyadmin/:/var/lib/phpmyadmin/:/usr/share/php/:/usr/share/javascript/
    </IfModule>
</Directory>

<Directory /usr/share/phpmyadmin/setup>
    Require all denied
</Directory>

<Directory /usr/share/phpmyadmin/libraries>
    Require all denied
</Directory>

<Directory /usr/share/phpmyadmin/templates>
    Require all denied
</Directory>
```

5. Creer le mot de passe HTTP Auth :
```bash
htpasswd -c /etc/phpmyadmin/htpasswd.setup admin
```

### Fail2ban pour phpMyAdmin

Creer `/etc/fail2ban/filter.d/phpmyadmin.conf` :
```
[Definition]
failregex = ^<HOST> -.*"(GET|POST).*/dbmanage.*
            user denied.*client: <HOST>
ignoreregex =
```

Creer `/etc/fail2ban/jail.d/phpmyadmin.conf` :
```
[phpmyadmin]
enabled = true
port = http,https
filter = phpmyadmin
logpath = /var/log/apache2/access.log
maxretry = 5
bantime = 3600
findtime = 600
```

```bash
systemctl restart fail2ban
```

### Creer un admin DB

```bash
mysql -u root -e "CREATE USER 'dbadmin'@'localhost' IDENTIFIED BY '<MOT_DE_PASSE>'; GRANT ALL PRIVILEGES ON *.* TO 'dbadmin'@'localhost' WITH GRANT OPTION; FLUSH PRIVILEGES;"
```

## DNSSEC

### Activer dans ISPConfig

DNS > Zones > `<DOMAINE>` > Zone settings > Sign Zone (DNSSEC) > Save

Recuperer les DS-Data affiches.

### Ajouter chez le registrar

**OVH :** DS Records > Ajouter
- Key tag, Algorithm 13, Digest type 2 (SHA-256), Digest

> **Piege OVH :** OVH peut retourner "Error while checking DNSKEYS" avec des NS personnalises. Retenter ou contacter le support.

**MTN (.ci) :** Envoyer les DS records au support car l'interface bug.