Skip to main content

Posts

Showing posts from 2019

How to Secure CWP Postfix and Dovecot with Lets Encrypt SSL Certificate ?

Postfix architecture is modular and contains different daemons each specifically handling only a few tasks. The most important daemons are the following:
master is the main daemon that starts all the other daemons.smtpd is the SMTP server daemon handling incoming connections to receive emails from another mail server or client.smtp is the SMTP client handling outgoing connections to send email out to another mail server.local is the local delivery agent responsible for delivering email to the local server.qmgr processes and controls all messages in the mail queue. Maps are used in postfix to control email routing. Such maps are used to accept or reject email, inform postfix about local recipients and more.

The main configuration files are main.cf which is the global configuration for all daemons and the master.cf which defines the runtime environment for the daemons. The master.cf configuration thereby overrides the configuration options from the main.cf.
Lets Secure Postfix First 
# vi …

How to Secure/Harden CWP Nginx Server ( Admin, Client & Webmail Panel ) with Strong Ciphers ?

By Default CWP Server is using Modified Nginx server which is called CWP server and It is used for Admin, Client & Webmail Panel Login. I am also using Let's Encrypt SSL for my CWP Admin, Client & Webmail Panel .
Follow This Article : ( Part 1)
CWP: How to Configure Let's Encrypt SSL Certificate for your server Hostname/FQDN on CWP7.admin
N.B: I am using the below cipherlist
https://cipherli.st/
https://mozilla.github.io/server-side-tls/ssl-config-generator/
https://wiki.mozilla.org/Security/Server_Side_TLS
https://ssl-config.mozilla.org/#server=apache&server-version=2.4.39&config=intermediate&openssl-version=1.0.2k-fips
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
https://ssldecoder.org/

CWP Admin Panel Link (by hostname)
CWP Admin Panel Link: http://server1.datahead.biz:2030
CWP Admin Panel Link: http://server1.datahead.biz:2086
CWP Admin Panel SSL Link: https://server1.datahead.biz:2031
CWP Admin Panel SSL Link: https://server1.da…

How to Enable logging of Email’s Subject Line in Postfix Maillog ?

By default Postfix MTA only capture ‘From’ and ‘To’ details in the log file (/var/log/maillog). There are some scenarios where we want that email’s subject should be capture in the maillog. This will very useful for email administrators when performing troubleshooting of problems related with email. There are simple steps to enable logging of the email subject in postfix maillog.

We are assuming that postfix is already up and running and will make below changes.
Step:1 Edit ‘/etc/postfix/main.cf’ file & uncomment below line:
#header_checks = regexp:/etc/postfix/header_checksStep:2 Append the below line in ‘/etc/postfix/header_checks’ [at the bottom]
/^Subject:/ WARNStep:3 Run postmap to apply the new configuration in /etc/postfix/header_checks
[root@server1 ~]# postmap /etc/postfix/header_checksStep:4 Restart or Reload the postfix server
[root@server1 ~]# systemctl restart postfix [root@server1 ~]# postfix reloadStep:5 Login to your Roundcube webmail and send an test with the subj…

CWP: How to install CSF Webmin module on CWP in CentOS 7 ?

This perl module is required for Statistical Graphs available from the csf UI. It is dependent on graphical libraries being installed for your OS (e.g. libgd, libpng, etc. which is beyond the scope of this document)

The perl module itself can be installed in a variety of ways, e.g.:

RedHat/CentOS/CloudLinux:
# yum install perl-GDGraph

Direct from cpan.org:
# perl -MCPAN -e shell
cpan> install GD::Graph

Webmin Module Installation/Upgrade
Webmin > Webmin Configuration > Webmin Modules >
From local file > /usr/local/csf/csfwebmin.tgz > Install Module


Uninstallation : Removing csf and lfd is even more simple:
# cd /etc/csf
# sh uninstall.s

The Article Based on:
https://download.configserver.com/csf/install.txt

PostfixAdmin: Invalid query: Table 'postfix.vacation_notification' doesn't exist,

Bug Fix: After login, click on “Fetch email” I got error “Invalid query: FUNCTION postfix.FROM_BASE64 does not exist” To fix it, edit /home/username/public_html/postfixadmin/model/PFAHandler.php at line 572:
# vi /home/datahead/public_html/postfixadmin/model/PFAHandler.php $base64_decode = "###KEY###"; Unable to Delete any Email Address:When I am trying to delete any email address, I'm getting below the error
Login to PhpMyAdmin using root user  and select the postfix database from left side and Select SQL and paste the below code then click on go button .
CREATE TABLE `vacation_notification` ( `on_vacation` varchar(255) NOT NULL, `notified` varchar(255) NOT NULL, `notified_at` timestamp NOT NULL default CURRENT_TIMESTAMP, PRIMARY KEY (`on_vacation`,`notified`) ) ENGINE=MyISAM DEFAULT CHARSET=latin1 COMMENT='Postfix Admin - Virtual Vacation Notifications';

Helpful Link:
Link 1
Link 2

CWP: How to Integrate Postfix Admin 3.1 with CentOS WebPanel on CentOS 7

Postfix Admin is a web based interface which allows users to configure and manage a Postfix based email server. With Postfix Admin you can create and manage multiple virtual domains, users and aliases and many more.

I have installed CWP7.admin on CentOS 7 and It's working fine with Postfix but i want to use PostfixAdmin with CentOS WebPanel .
Login to your user panel : https://host.datahead.biz:2083/ and create a sub-domain like postfixadmin.datahead.biz . Go to Domains >> Sub Domains >> Add a New SubDomain

Now Restart Apache & DNS server from your admin panel. If you get any error or unable browse your subdomian then fix the permission (Go to User Accounts >> Fix Permission) . Install AutoSSL for that subdomain. Now Login to your server using SSH
# cd /usr/local/src/ # VERSION=3.1 # wget -q https://downloads.sourceforge.net/project/postfixadmin/postfixadmin/postfixadmin-${VERSION}/postfixadmin-${VERSION}.tar.gz # tar xzf postfixadmin-${VERSION}.tar.gz # mv po…

How to Secure MariaDB for VestaCP and CWP ?

If you are using VestaCP or CentOS Webpanel then this tutorial will guide you through some basic steps you can take to secure your MariaDB or MySQL databases, and ensure that they are not an open door into your VPS. However, like most software, these tools can be security liabilities if they are configured incorrectly.

For the sake of simplicity and illustration, we will use the MariaDB 10.1 server on a CentOS 7.6 VPS instance.
Now run the script called "mysql_secure_installation". This will guide us through some procedures that will remove some defaults that are dangerous to use in a production environment.
# mysql_secure_installation
It will first prompt you for the root password you set up during installation. Immediately following, you will be asked a series of questions, beginning with if you'd like to change the root password.

This is another opportunity to change your password to something secure if you have not done so already.
You should answer "Y" (for…

How to find out & Change VestaCP MySQL/MariaDB root Password ?

If you forget the MySQL/MariaDB root password, no worries to find out the mysql root password.
The password is stored at: /usr/local/vesta/conf/mysql.conf and /root/.my.cnf
Before do anything , create a backup file.
# cp /usr/local/vesta/conf/mysql.conf /usr/local/vesta/conf/mysql.conf.bak # cp /root/.my.cnf /root/.my.cnf.bak Use this syntax to change MySQL/MariaDB root password
# mysqladmin -u root -pOLDPASSWORD password 'NEWPASSWORD' Change the root password
# mysqladmin -u root -pgX7wlY5V3F password 'gR7wlY6V9A' Now Update the newly changed password
# vi /usr/local/vesta/conf/mysql.conf HOST='localhost' USER='root' PASSWORD='gR7wlY6V9A' CHARSETS='UTF8,LATIN1,WIN1250,WIN1251,WIN1252,WIN1256,WIN1258,KOI8' MAX_DB='500' U_SYS_USERS='admin,datahead' U_DB_BASES='3' SUSPENDED='no' TIME='15:10:16' DATE='2019-04-17' # vi /root/.my.cnf [client] password='gR7wlY6V9A'

CWP: How to Add Let's Encrypt SSL to Monit on CentOS 7.6

I have installed Let's Encrypt SSL certificate for Server FQDN and that certificate i will use for monit. So In this tutorial we are going to show you, how to add Let's Encrypt SSL certificate for Monit along with CentOS Webpanel on CentOS 7.

Prerequisites:
To complete this tutorial, you will need:
1. CentOS Linux release 7.6.1810 (Core)
2. CWP7.admin , CWP version: 0.9.8.772
3. CSF Firewall
4. Let's Encrypt SSL Certificate (Installed)

Step 1:
Install HTTP client library
# yum install python-httplib2 To enable Let's Encrypt SSL for Monit's HTTP GUI, Open Monit Configuration File and uncomment the below line
# vi /etc/monitrc set ssl { version : TLSV12 verify : enable } with ssl { pemfile: /etc/ssl/certs/monit.pem } Check Monit syntax for error
# monit -t Control file syntax OK Create a file with touch command
# touch /etc/ssl/certs/monit.pem
Step 2:
Let's Encrypt SSL location for your SERVER_FQDN: /etc/letsencrypt…

CWP: How to monitor CWP Server Services using Monit on CentOS 7.6

Monit is a free open source and a very helpful program that automatically monitors and manages server process, files, directories, checksums, permissions, filesystems and services like Apache, Nginx, MySQL, FTP, SSH, Postfix and so on in a UNIX/Linux based systems and provides an excellent monitoring functionality to system administrators.
You can reduce the downtime using Monit because when any services goes down , Monit will check it and start the services automatically, example: if your dns service is down then monit will check, if found it's down then monit will start the dns service automatically. One interesting thing is that monit runs it own httpd server. If your apache server is down, monit will running using it's own server.
In this tutorial we are going to show you, how to install Monit along with CentOS Webpanel on CentOS 7.
Prerequisites:
To complete this tutorial, you will need:
1. CentOS Linux release 7.6.1810 (Core)
2. CWP7.admin , CWP version: 0.9.8.772
3. CSF …

CWP: How to Increase your Server Security using CSF Firewall on CentOS 7

Access CSF UI on your browser with the specified port and click on "Check Server Security" ,
After that now check the report below:

# vi /etc/ssh/sshd_config Port 22XX UseDNS no # systemctl restart sshd allow the new ssh port on CSF firewall# vi /etc/my.cnf [mysqld] local-infile=0 # systemctl restart mariadb You can also enable 'RESTRICT_SYSLOG option check, LF_POP3D option check, LF_IMAPD option check, SYSLOG_CHECK option check, RESTRICT_UI option check, Check SSH PasswordAuthentication'.  This option helps prevent brute force attacks on your server services

Important setting for me :
# cd /usr/local/csf/bin/ # perl csftest.pl #vi /etc/csf/csf.conf TESTING = "0" Don't Block IP addresses that are in the csf.allow files. IGNORE_ALLOW = "1" ICMP_IN = "1" ICMP_OUT = "1" LF_SSH_EMAIL_ALERT = "1" LF_SU_EMAIL_ALERT = "1" LF_ALERT_TO = "admin@datahead.biz" LF_ALERT_FROM = "" #systemctl s…

CWP: How to Enable GUI for CSF on CentOS 7

CSF Web UI required some of Perl modules to be installed on your system. Use the following commands to check the required modules are installed operating system. If not present please install those packages .
# yum info perl-IO-Socket-SSL.noarch perl-Net-SSLeay perl-Net-LibIDN perl-IO-Socket-INET6 perl-Socket6 To enable CSF web UI edit /etc/csf/csf.conf file
# vi /etc/csf/csf.conf # 0 = Unrestricted UI # 1 = Restricted UI # 2 = Disabled UI RESTRICT_UI = "0" # 1 to enable, 0 to disable UI = "1" # Do NOT enable access to this port in TCP_IN, instead only allow trusted IP's # to the port using Advanced Allow Filters (see readme.txt) UI_PORT = "1025" # Leave blank to bind to all IP addresses on the server UI_IP = "" # This should be a secure, hard to guess username # This must be changed from the default UI_USER = "admin" # This must be changed from the default UI_PASS = "adminX" edit /etc/csf/ui/ui.allow configuration f…

How to hide Nameserver software version on Centos 7

Hide DNS Software VersionSometimes a new vulnerability is found in DNS software and script kiddies are scanning the Internet to exploit unpatched systems. It's a best practice to hide software version on your DNS servers, although this is not a real protection it just makes a little harder to find your servers via scanning. Use dig command to find which version is running on your name servers: $ dig +short @ns1.example.com version.bind txt chaos "9.8.2rc1-RedHat-9.8.2-0.23.rc1.el6_5.1" BindTo hide version in when using Bind, open named.conf configuration file using your favorite editor, go to options section and set a custom version string using version option. Example: // /etc/named.conf options{// Hide bind version version"unknown";}; Restart the server (use bind9 instead of named on systems based on Debian): $ sudo service named restart Stopping named: . [ OK ] Starting named: [ …

How to Update ROOT Hints DNS ?

My WebServer DNS root zone file is outdated and it has no information about IPv6 and recently changed root server IP address. How do I update my root hints data file under CentOS 7 Server?

Under Red Hat / CentOS / Fedora Linux, default location is /var/named/named.root, enter:
# wget --user=ftp --password=ftp ftp://ftp.rs.internic.net/domain/db.cache -O /var/named/named.root Reload rndc to update information, enter:
# rndc reload Another option is run dig command to fetch information:
# dig +bufsize=1200 +norec NS . @a.root-servers.net > /var/named/named.root The root zone's nameservers change over time, don't assume this list is current. Always download a new version of db.cache once or twice year is sufficient.

This article based on: Link 1Link 2

CWP DNS Part 2 : How to Configure DNS properly for CentOS WebPanel on CentOS 7.6

7.Open Main Configuration file
# vi /etc/named.conf 12 options { 13 listen-on port 53 { any; }; 14 listen-on-v6 port 53 { ::1; }; 15 directory "/var/named"; 16 dump-file "/var/named/data/cache_dump.db"; 17 statistics-file "/var/named/data/named_stats.txt"; 18 memstatistics-file "/var/named/data/named_mem_stats.txt"; 19 recursing-file "/var/named/data/named.recursing"; 20 secroots-file "/var/named/data/named.secroots"; 21 allow-query { any; }; 33 recursion no; 34 35 dnssec-enable yes; 36 dnssec-validation yes; 54 zone "." IN { 55 type hint; 56 file "named.ca"; 57 }; 58 59 include "/etc/named.rfc1912.zones"; 60 include "/etc/named.root.key"; 61 …

CWP DNS Part 1 : How to Configure DNS properly for CentOS WebPanel on CentOS 7.6

After hosting my parent domain on CWP7.admin, I am getting dns error and i'm not able access my server using my server FQDN but i can access using my server IP.
So what can i do for that problem ?

Yes, you have to fix the error .

Environment Details:
Distro Name: CentOS Linux release 7.6.1810 (Core)
CentOS-Web Panel version: CWP7.admin
CWP version: 0.9.8.757
WebServer: Apache Only
FQDN: host.datahead.biz
IP: 192.120.10.3

1.Change Hostname Permanently:
# hostnamectl set-hostname host.datahead.biz# hostnamectl Static hostname: host.datahead.biz Icon name: computer-vm Chassis: vm Machine ID: 7400071490ea4f7d931374824ad4b52c Boot ID: 6e1f2d76495d4b318c25c4a1195aa130 Virtualization: vmware Operating System: CentOS Linux 7 (Core) CPE OS Name: cpe:/o:centos:centos:7 Kernel: Linux 3.10.0-862.14.4.el7.x86_64 Architecture: x86-64 It also writes this information to the /etc/hostname file as well.
# cat /etc/hostname host.d…