13. Securite

Certificats Let's Encrypt pour les outils

ISPConfig

Les certificats sont dans /var/www/clients/clientX/webY/ssl/<DOMAINE>-le.crt et .key.

SSL_DIR="/var/www/clients/client1/web7/ssl"
ISP_SSL="/usr/local/ispconfig/interface/ssl"

cp $SSL_DIR/<DOMAINE>-le.crt $ISP_SSL/ispserver.crt
cp $SSL_DIR/<DOMAINE>-le.key $ISP_SSL/ispserver.key

# Creer PEM (cert + key)
cat $ISP_SSL/ispserver.crt $ISP_SSL/ispserver.key > $ISP_SSL/ispserver.pem

systemctl restart apache2

Postfix / Dovecot

Les certificats sont automatiquement utilises via le PEM ISPConfig. Pour le SNI multi-domaines, voir 08-sni-mail.md.

phpMyAdmin securise

Changer l'URL et ajouter HTTP Auth

Desactiver l'alias global :

a2disconf phpmyadmin

DNS A dbmanage -> <IP>
Sous-domaine ISPConfig dbmanage.<DOMAINE> (SSL, LE, PHP-FPM, HTTPS redirect)
Apache Directives :

Alias / /usr/share/phpmyadmin/

<Directory /usr/share/phpmyadmin>
    Options SymLinksIfOwnerMatch
    DirectoryIndex index.php

    AuthType Basic
    AuthName "Database Management - Restricted Access"
    AuthUserFile /etc/phpmyadmin/htpasswd.setup
    Require valid-user

    <IfModule mod_php.c>
        php_admin_value upload_tmp_dir /var/lib/phpmyadmin/tmp
        php_admin_value open_basedir /usr/share/phpmyadmin/:/etc/phpmyadmin/:/var/lib/phpmyadmin/:/usr/share/php/:/usr/share/javascript/
    </IfModule>
</Directory>

<Directory /usr/share/phpmyadmin/setup>
    Require all denied
</Directory>

<Directory /usr/share/phpmyadmin/libraries>
    Require all denied
</Directory>

<Directory /usr/share/phpmyadmin/templates>
    Require all denied
</Directory>

Creer le mot de passe HTTP Auth :

htpasswd -c /etc/phpmyadmin/htpasswd.setup admin

Fail2ban pour phpMyAdmin

Creer /etc/fail2ban/filter.d/phpmyadmin.conf :

[Definition]
failregex = ^<HOST> -.*"(GET|POST).*/dbmanage.*
            user denied.*client: <HOST>
ignoreregex =

Creer /etc/fail2ban/jail.d/phpmyadmin.conf :

[phpmyadmin]
enabled = true
port = http,https
filter = phpmyadmin
logpath = /var/log/apache2/access.log
maxretry = 5
bantime = 3600
findtime = 600

systemctl restart fail2ban

Creer un admin DB

mysql -u root -e "CREATE USER 'dbadmin'@'localhost' IDENTIFIED BY '<MOT_DE_PASSE>'; GRANT ALL PRIVILEGES ON *.* TO 'dbadmin'@'localhost' WITH GRANT OPTION; FLUSH PRIVILEGES;"

DNSSEC

Activer dans ISPConfig

DNS > Zones > <DOMAINE> > Zone settings > Sign Zone (DNSSEC) > Save

Recuperer les DS-Data affiches.

Ajouter chez le registrar

OVH : DS Records > Ajouter

Key tag, Algorithm 13, Digest type 2 (SHA-256), Digest

Piege OVH : OVH peut retourner "Error while checking DNSKEYS" avec des NS personnalises. Retenter ou contacter le support.

MTN (.ci) : Envoyer les DS records au support car l'interface bug.

2.9 KiB Raw Blame History