123 lines
2.9 KiB
Markdown
123 lines
2.9 KiB
Markdown
# 13. Securite
|
|
|
|
## Certificats Let's Encrypt pour les outils
|
|
|
|
### ISPConfig
|
|
|
|
Les certificats sont dans `/var/www/clients/clientX/webY/ssl/<DOMAINE>-le.crt` et `.key`.
|
|
|
|
```bash
|
|
SSL_DIR="/var/www/clients/client1/web7/ssl"
|
|
ISP_SSL="/usr/local/ispconfig/interface/ssl"
|
|
|
|
cp $SSL_DIR/<DOMAINE>-le.crt $ISP_SSL/ispserver.crt
|
|
cp $SSL_DIR/<DOMAINE>-le.key $ISP_SSL/ispserver.key
|
|
|
|
# Creer PEM (cert + key)
|
|
cat $ISP_SSL/ispserver.crt $ISP_SSL/ispserver.key > $ISP_SSL/ispserver.pem
|
|
|
|
systemctl restart apache2
|
|
```
|
|
|
|
### Postfix / Dovecot
|
|
|
|
Les certificats sont automatiquement utilises via le PEM ISPConfig. Pour le SNI multi-domaines, voir [08-sni-mail.md](08-sni-mail.md).
|
|
|
|
## phpMyAdmin securise
|
|
|
|
### Changer l'URL et ajouter HTTP Auth
|
|
|
|
1. Desactiver l'alias global :
|
|
```bash
|
|
a2disconf phpmyadmin
|
|
```
|
|
|
|
2. DNS A `dbmanage` -> `<IP>`
|
|
3. Sous-domaine ISPConfig `dbmanage.<DOMAINE>` (SSL, LE, PHP-FPM, HTTPS redirect)
|
|
4. Apache Directives :
|
|
|
|
```apache
|
|
Alias / /usr/share/phpmyadmin/
|
|
|
|
<Directory /usr/share/phpmyadmin>
|
|
Options SymLinksIfOwnerMatch
|
|
DirectoryIndex index.php
|
|
|
|
AuthType Basic
|
|
AuthName "Database Management - Restricted Access"
|
|
AuthUserFile /etc/phpmyadmin/htpasswd.setup
|
|
Require valid-user
|
|
|
|
<IfModule mod_php.c>
|
|
php_admin_value upload_tmp_dir /var/lib/phpmyadmin/tmp
|
|
php_admin_value open_basedir /usr/share/phpmyadmin/:/etc/phpmyadmin/:/var/lib/phpmyadmin/:/usr/share/php/:/usr/share/javascript/
|
|
</IfModule>
|
|
</Directory>
|
|
|
|
<Directory /usr/share/phpmyadmin/setup>
|
|
Require all denied
|
|
</Directory>
|
|
|
|
<Directory /usr/share/phpmyadmin/libraries>
|
|
Require all denied
|
|
</Directory>
|
|
|
|
<Directory /usr/share/phpmyadmin/templates>
|
|
Require all denied
|
|
</Directory>
|
|
```
|
|
|
|
5. Creer le mot de passe HTTP Auth :
|
|
```bash
|
|
htpasswd -c /etc/phpmyadmin/htpasswd.setup admin
|
|
```
|
|
|
|
### Fail2ban pour phpMyAdmin
|
|
|
|
Creer `/etc/fail2ban/filter.d/phpmyadmin.conf` :
|
|
```
|
|
[Definition]
|
|
failregex = ^<HOST> -.*"(GET|POST).*/dbmanage.*
|
|
user denied.*client: <HOST>
|
|
ignoreregex =
|
|
```
|
|
|
|
Creer `/etc/fail2ban/jail.d/phpmyadmin.conf` :
|
|
```
|
|
[phpmyadmin]
|
|
enabled = true
|
|
port = http,https
|
|
filter = phpmyadmin
|
|
logpath = /var/log/apache2/access.log
|
|
maxretry = 5
|
|
bantime = 3600
|
|
findtime = 600
|
|
```
|
|
|
|
```bash
|
|
systemctl restart fail2ban
|
|
```
|
|
|
|
### Creer un admin DB
|
|
|
|
```bash
|
|
mysql -u root -e "CREATE USER 'dbadmin'@'localhost' IDENTIFIED BY '<MOT_DE_PASSE>'; GRANT ALL PRIVILEGES ON *.* TO 'dbadmin'@'localhost' WITH GRANT OPTION; FLUSH PRIVILEGES;"
|
|
```
|
|
|
|
## DNSSEC
|
|
|
|
### Activer dans ISPConfig
|
|
|
|
DNS > Zones > `<DOMAINE>` > Zone settings > Sign Zone (DNSSEC) > Save
|
|
|
|
Recuperer les DS-Data affiches.
|
|
|
|
### Ajouter chez le registrar
|
|
|
|
**OVH :** DS Records > Ajouter
|
|
- Key tag, Algorithm 13, Digest type 2 (SHA-256), Digest
|
|
|
|
> **Piege OVH :** OVH peut retourner "Error while checking DNSKEYS" avec des NS personnalises. Retenter ou contacter le support.
|
|
|
|
**MTN (.ci) :** Envoyer les DS records au support car l'interface bug.
|