danwin1210/hosting
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
185 Commits 1 Branch 0 Tags
4ff2fae6a552311f0d64284ef6b42a60cd3b35f2
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Daniel Winzen 4ff2fae6a5 Introduced second parameter to setup_chroot.sh to copy extra binaries 2019-02-11 07:17:01 +01:00
Daniel WinzenandGitHub b1bf9eb42b Merge pull request #43 from NoahvdAa/patch-4 
Made link clickable.
 2019-02-03 14:14:49 +01:00
Daniel WinzenandGitHub 34cbd13d27 Merge pull request #44 from NoahvdAa/patch-5 
Fixed a typo, made a few sentences a bit nicer.
 2019-02-03 14:14:17 +01:00
Daniel Winzen c637c98510 Fixed typo in csrf token hidden input field 2019-01-28 05:48:41 +01:00
Daniel Winzen 22c687b0e0 Fixed syntax error 2019-01-27 18:31:21 +01:00
Daniel Winzen 4aa51f4371 Set default file manager path to /www/ 2019-01-27 17:41:24 +01:00
Daniel Winzen 9c5294e64e Add csrf tokens to all sensitive forms 2019-01-27 17:41:02 +01:00
Daniel WinzenandGitHub cf83b9901a Merge pull request #42 from NoahvdAa/patch-3 
Added CSRF protection to file manager.
 2019-01-27 16:22:20 +01:00
Daniel Winzen 7da6b8feed Install PHPMyAdmin locally as distributions ship outdated version 2019-01-26 16:48:38 +01:00
Daniel Winzen 7661c0ccdb With more than 10 crashes within 10 minutes we should restart php 2019-01-26 14:17:09 +01:00
Daniel Winzen 7eed4a05d7 hidden service dirs now contain authorized_clients folder 2019-01-25 20:32:35 +01:00
Daniel Winzen e537e06118 Enable exec() related functions since we now have resource control in place 2019-01-22 21:15:32 +01:00
Daniel Winzen bdf26c8d00 Introduce CPU and Memory resource control for php and all child-processes 2019-01-22 21:12:50 +01:00
Daniel WinzenandGitHub 98d6a46aff Merge pull request #41 from NoahvdAa/patch-2 
Fixed a small typo
 2019-01-20 11:50:31 +01:00
Daniel Winzen 11574e3e3f nproc seems to be a global limit, not per session - increased accoringly 2019-01-08 18:20:24 +01:00
Daniel Winzen 5eab397200 Randomise DB (user)names to reduce attack surface + allow multiple DBs per user 2019-01-07 22:26:33 +01:00
Daniel Winzen 838b6c3b6f disable systemd-resolver and tor@default apparmor profile 2019-01-06 20:35:04 +01:00
Daniel Winzen 74417d1d5b nginx default site is now managed by the script 2019-01-06 19:48:35 +01:00
Daniel Winzen 6a834142ba Fixed typo 2019-01-06 19:44:49 +01:00
Daniel Winzen dfe7f7d9e7 when shell access is enabled, we shouldn't use force-command in sshd_config 2019-01-06 19:35:49 +01:00
Daniel Winzen 09ca89029e apply security restrictions in limits.conf 2019-01-06 19:33:12 +01:00
Daniel Winzen c46a2584fa Add shell access and scp support 2019-01-06 18:20:02 +01:00
Daniel Winzen b5d8b79b8e Disabled STRICT_TRANS_TABLES for compatibility 2019-01-05 12:15:56 +01:00
Daniel WinzenandGitHub ee7e1d11ca Merge pull request #40 from NoahvdAa/patch-1 
Added the "select all" option to the file manager.
 2019-01-04 21:29:44 +01:00
Daniel WinzenandGitHub 899da11a56 Merge pull request #38 from NoahvdAa/patch-1 
Fixed a typo
 2019-01-04 09:59:35 +01:00
Daniel Winzen 7e4ed95ba8 Additional direcotries would have to be included in chroots to be useful - removed 2019-01-03 07:20:54 +01:00
Daniel Winzen e536a5c544 Minor nginx config fix 2019-01-01 20:43:21 +01:00
Daniel Winzen cff617379d tmp is created by setup_chroot script already 2019-01-01 14:34:06 +01:00
Daniel Winzen 6b6efc2fc6 Logs are stored outside chroot - don't check existence and let nginx handle it 2019-01-01 13:54:36 +01:00
Daniel Winzen 55bc8cd757 Introduce mysqld socket stream forwarding with nginx for chroot jails 2019-01-01 13:47:30 +01:00
Daniel Winzen 0f38bd2449 Improved privilege separation 2019-01-01 02:24:22 +01:00
Daniel Winzen a5b0de4b07 Added setup_chroot.sh script 2018-12-27 22:32:37 +01:00
Daniel Winzen 91167d1f45 Fix systemd namespace issues taking effect after reboot 2018-12-24 06:27:33 +01:00
Daniel Winzen e0bfc5e633 Our hidden service should run on v3 by default 2018-12-10 16:58:50 +01:00
Daniel Winzen a901e25bb4 Instructions to prepare user disk quota 2018-12-09 12:25:25 +01:00
Daniel Winzen 08cc492b86 New imap.enable_insecure_rsh php.ini option protects against imap_open exploit 
http://php.net/manual/en/imap.configuration.php
 2018-12-08 11:01:06 +01:00
Daniel Winzen 11c055ebcf Remove commeted options 2018-12-07 22:18:49 +01:00
Daniel Winzen 4f6539b31d Introduce systemd.exec restrictions for better security 2018-12-07 21:54:44 +01:00
Daniel Winzen 8e155012a7 Suppress chatty dovecot messages 2018-12-07 21:48:22 +01:00
Daniel Winzen 4b25310396 Simplified sshd_config 2018-12-07 13:25:30 +01:00
Daniel Winzen 756e16b533 Fixed potential race condition pointed out in issue #31 2018-12-06 16:54:35 +01:00
Daniel Winzen 5cd13e9269 Introduced selection between v2, v3 and custom hidden service 2018-12-06 16:24:35 +01:00
Daniel Winzen 305c8bc0c3 Fix mariadb 10.3 compatibility by adding default values 2018-12-05 22:19:46 +01:00
Daniel Winzen be005c3137 Renamed config file 2018-12-05 17:18:46 +01:00
Daniel Winzen aedd8a1e6a Update to latest mariadb version 2018-12-05 17:18:11 +01:00
Daniel Winzen 64163823a8 dnsmasq should only listen on lo interface 2018-12-05 07:59:46 +01:00
Daniel Winzen fd95a4e2e3 v3 hidden service export to disk + hostname file is auto generated by tor 2018-12-04 21:48:45 +01:00
Daniel Winzen c9cddc9f86 Username should be a prepared variable 2018-12-04 21:27:35 +01:00
Daniel WinzenandGitHub d0710d3d20 Merge pull request #37 from DanWin/revert-35-patch-1 
Revert " Disabling emulated parameters"
 2018-12-04 21:13:51 +01:00
Daniel WinzenandGitHub 0fc4412404 Revert " Disabling emulated parameters" 2018-12-04 21:10:36 +01:00
Daniel Winzen ba71455ca5 Introduce DEFAULT_PHP_VERSION 2018-12-04 20:48:08 +01:00
Daniel Winzen 4e163a7e2d Fixed syntax error 2018-12-04 15:26:24 +01:00
Daniel Winzen c174251826 exim4 might interfere with postfix 2018-12-04 13:36:16 +01:00
Daniel Winzen 4f059e66f7 Droped php7.2 systemd.service files 2018-12-04 13:29:17 +01:00
Daniel Winzen c651bb65c7 Add jounald.conf 2018-12-03 17:22:23 +01:00
Daniel Winzen 6ee51f3d7e removed stray mention of php7.2 2018-12-02 21:44:07 +01:00
Daniel Winzen 22066309d5 Add login.defs file 2018-12-02 21:41:31 +01:00
Daniel Winzen 363d1b31ad Debian sid dropped php7.2 support - move to 7.3 only 2018-12-02 21:17:11 +01:00
Daniel Winzen 2e0e69d605 We don't need apt repository translations 2018-12-02 19:31:26 +01:00
Daniel Winzen 2149bc9fd8 update paragonie/sodium_compat dependency 2018-12-02 10:45:51 +01:00
Daniel Winzen 7111fa3a65 Prevent httpoxy vulnerability in PHP applications 2018-11-29 20:56:39 +01:00
Daniel WinzenandGitHub 921c43122c Merge pull request #35 from teikakki/patch-1 
Disabling emulated parameters
 2018-11-28 21:05:56 +01:00
Daniel Winzen 36fc7103cb Add hidden service v3 keygen and parser for base64 encoded secret keys 2018-11-25 14:36:28 +01:00
Daniel Winzen f0afbe14c9 Add sodium_compat composer dependency for v3 hidden_services 2018-11-24 14:56:24 +01:00
Daniel Winzen 9de11a9722 Dropped PHP7.1 support and install composer 2018-11-24 10:38:59 +01:00
Daniel Winzen 910381fee2 Removed php7.0 setup instructions 2018-11-19 21:23:34 +01:00
Daniel WinzenandGitHub 7d032f4955 Merge pull request #28 from jtesta/sshd_hardening 
Hardened SSH Service
 2018-11-19 21:20:43 +01:00
Daniel Winzen 41b33f2c51 Drop PHP7.0 support 2018-11-18 20:50:35 +01:00
Daniel Winzen db626a54a4 disable imap_open because of https://github.com/Bo0oM/PHP_imap_open_exploit 2018-11-17 10:15:15 +01:00
Daniel Winzen f4ca23336b Add clamav virus scan to mails 2018-11-11 11:17:20 +01:00
Daniel Winzen bb21f9f10b Reload disabled php versions since accounts can still be deleted 2018-10-28 09:31:00 +01:00
Daniel Winzen 5f3dfefa02 Drop now redundant config 2018-10-28 09:07:20 +01:00
Daniel Winzen b69293ab6d Dynamic supported versions on frontpage 2018-10-28 09:01:31 +01:00
Daniel Winzen 58b5efb96c Added suspend hidden service feature + disabled php7.0 for new accounts 2018-10-28 08:48:30 +01:00
Daniel Winzen 1884f4b08b php is .ini not .conf 2018-10-26 19:14:29 +02:00
Daniel Winzen 9985ba4864 Add PHP7.3 support and let setup.php write initial config files 2018-10-24 19:59:02 +02:00
Daniel Winzen d5d7078776 Allow editing hidden service options 2018-10-22 21:45:08 +02:00
Daniel Winzen b80f30ac03 Ignore insecure 777 permissions set by users on logrotate 2018-10-21 10:44:23 +02:00
Daniel Winzen cfb19915b5 Optimized find query to only search within each users tmp directory 2018-10-20 21:08:44 +02:00
Daniel Winzen d9e496930d Add HiddenServiceMaxStreams option and service_instances table 2018-10-20 20:44:10 +02:00
Daniel Winzen 2cee59dc6f Structure changes for future features 2018-10-20 18:20:27 +02:00
Daniel Winzen 96efd92ab1 bump dbversion 2018-10-17 21:51:20 +02:00
Daniel Winzen 1f2ff2176b Save DB information in separate table 2018-10-17 21:50:20 +02:00
Daniel Winzen 6eb068222c Refactor DB foreign keys to auto_incrementing id instead of onion 
Allows moving domains into separate table at a later stage
 2018-10-16 21:09:16 +02:00
Daniel Winzen 81c2364b7b Better load distribution on multiple relays 2018-09-23 20:09:04 +02:00
Daniel Winzen acc8782043 Add privacy policy checkbox (required by GDPR) 2018-09-10 19:30:12 +02:00
Daniel Winzen 382ea73efb Update firewall rules 2018-09-10 19:20:11 +02:00
Daniel Winzen 2c634b889c Add dnsmasq DNS caching and performance tune tor instances 2018-09-10 19:11:02 +02:00
Daniel Winzen 156a66a3ff Added missing php7.0-intl package 2018-09-10 19:06:51 +02:00
Daniel Winzen 1d157473e6 Move account folder creation into cron.php 2018-07-14 10:41:44 +02:00
Daniel Winzen f43e699b91 chroot postfix 2018-06-18 20:24:00 +02:00
Daniel Winzen e6d798370f secmail.pro dropped rewriting of .onion to .pro domain 2018-06-02 12:05:30 +02:00
Daniel Winzen 943ca4b151 Enable fastcgi_cache 2018-05-15 20:45:49 +02:00
Daniel Winzen dda49153b3 Buffer access log writes to reduce IO 2018-05-13 09:04:12 +02:00
Daniel Winzen 1a9ee646c6 Adapt firewall rule to new ftp ports 2018-05-06 09:57:24 +02:00
Daniel Winzen c6498ea1dc Increase available ports for passive ftp 2018-05-05 14:10:01 +02:00
Daniel Winzen 49a5b187b0 Increase buffer to get rid of errors on large response headers (e.g. cookies) 
upstream sent too big header while reading response header
 2018-04-22 15:07:00 +02:00
Daniel Winzen 300cd647df Increase limits and add putenv to disabled functions (vulerability) 
Potential security vulnerability:
<?php
putenv("LD_PRELOAD=/home/site.onion/libtest.so");
mail("test@localhost","hacked","you");
 2018-04-22 09:11:43 +02:00
Daniel Winzen c9487adb1a MariaDB hit open_files_limit -> increase it 2018-03-12 06:47:18 +01:00
Daniel Winzen e6ac79457f We have proper firewalling, fsockopen no longer needs to be disabled 2018-03-11 20:26:19 +01:00