danwin1210/hosting
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
166 Commits 1 Branch 0 Tags
7f7b228df639c2bd89eca3352e0d5b963c3ed87a
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Daniel Winzen 11574e3e3f nproc seems to be a global limit, not per session - increased accoringly 2019-01-08 18:20:24 +01:00
Daniel Winzen 5eab397200 Randomise DB (user)names to reduce attack surface + allow multiple DBs per user 2019-01-07 22:26:33 +01:00
Daniel Winzen 838b6c3b6f disable systemd-resolver and tor@default apparmor profile 2019-01-06 20:35:04 +01:00
Daniel Winzen 74417d1d5b nginx default site is now managed by the script 2019-01-06 19:48:35 +01:00
Daniel Winzen 6a834142ba Fixed typo 2019-01-06 19:44:49 +01:00
Daniel Winzen dfe7f7d9e7 when shell access is enabled, we shouldn't use force-command in sshd_config 2019-01-06 19:35:49 +01:00
Daniel Winzen 09ca89029e apply security restrictions in limits.conf 2019-01-06 19:33:12 +01:00
Daniel Winzen c46a2584fa Add shell access and scp support 2019-01-06 18:20:02 +01:00
Daniel Winzen b5d8b79b8e Disabled STRICT_TRANS_TABLES for compatibility 2019-01-05 12:15:56 +01:00
Daniel WinzenandGitHub ee7e1d11ca Merge pull request #40 from NoahvdAa/patch-1 
Added the "select all" option to the file manager.
 2019-01-04 21:29:44 +01:00
Daniel WinzenandGitHub 899da11a56 Merge pull request #38 from NoahvdAa/patch-1 
Fixed a typo
 2019-01-04 09:59:35 +01:00
Daniel Winzen 7e4ed95ba8 Additional direcotries would have to be included in chroots to be useful - removed 2019-01-03 07:20:54 +01:00
Daniel Winzen e536a5c544 Minor nginx config fix 2019-01-01 20:43:21 +01:00
Daniel Winzen cff617379d tmp is created by setup_chroot script already 2019-01-01 14:34:06 +01:00
Daniel Winzen 6b6efc2fc6 Logs are stored outside chroot - don't check existence and let nginx handle it 2019-01-01 13:54:36 +01:00
Daniel Winzen 55bc8cd757 Introduce mysqld socket stream forwarding with nginx for chroot jails 2019-01-01 13:47:30 +01:00
Daniel Winzen 0f38bd2449 Improved privilege separation 2019-01-01 02:24:22 +01:00
Daniel Winzen a5b0de4b07 Added setup_chroot.sh script 2018-12-27 22:32:37 +01:00
Daniel Winzen 91167d1f45 Fix systemd namespace issues taking effect after reboot 2018-12-24 06:27:33 +01:00
Daniel Winzen e0bfc5e633 Our hidden service should run on v3 by default 2018-12-10 16:58:50 +01:00
Daniel Winzen a901e25bb4 Instructions to prepare user disk quota 2018-12-09 12:25:25 +01:00
Daniel Winzen 08cc492b86 New imap.enable_insecure_rsh php.ini option protects against imap_open exploit 
http://php.net/manual/en/imap.configuration.php
 2018-12-08 11:01:06 +01:00
Daniel Winzen 11c055ebcf Remove commeted options 2018-12-07 22:18:49 +01:00
Daniel Winzen 4f6539b31d Introduce systemd.exec restrictions for better security 2018-12-07 21:54:44 +01:00
Daniel Winzen 8e155012a7 Suppress chatty dovecot messages 2018-12-07 21:48:22 +01:00
Daniel Winzen 4b25310396 Simplified sshd_config 2018-12-07 13:25:30 +01:00
Daniel Winzen 756e16b533 Fixed potential race condition pointed out in issue #31 2018-12-06 16:54:35 +01:00
Daniel Winzen 5cd13e9269 Introduced selection between v2, v3 and custom hidden service 2018-12-06 16:24:35 +01:00
Daniel Winzen 305c8bc0c3 Fix mariadb 10.3 compatibility by adding default values 2018-12-05 22:19:46 +01:00
Daniel Winzen be005c3137 Renamed config file 2018-12-05 17:18:46 +01:00
Daniel Winzen aedd8a1e6a Update to latest mariadb version 2018-12-05 17:18:11 +01:00
Daniel Winzen 64163823a8 dnsmasq should only listen on lo interface 2018-12-05 07:59:46 +01:00
Daniel Winzen fd95a4e2e3 v3 hidden service export to disk + hostname file is auto generated by tor 2018-12-04 21:48:45 +01:00
Daniel Winzen c9cddc9f86 Username should be a prepared variable 2018-12-04 21:27:35 +01:00
Daniel WinzenandGitHub d0710d3d20 Merge pull request #37 from DanWin/revert-35-patch-1 
Revert " Disabling emulated parameters"
 2018-12-04 21:13:51 +01:00
Daniel WinzenandGitHub 0fc4412404 Revert " Disabling emulated parameters" 2018-12-04 21:10:36 +01:00
Daniel Winzen ba71455ca5 Introduce DEFAULT_PHP_VERSION 2018-12-04 20:48:08 +01:00
Daniel Winzen 4e163a7e2d Fixed syntax error 2018-12-04 15:26:24 +01:00
Daniel Winzen c174251826 exim4 might interfere with postfix 2018-12-04 13:36:16 +01:00
Daniel Winzen 4f059e66f7 Droped php7.2 systemd.service files 2018-12-04 13:29:17 +01:00
Daniel Winzen c651bb65c7 Add jounald.conf 2018-12-03 17:22:23 +01:00
Daniel Winzen 6ee51f3d7e removed stray mention of php7.2 2018-12-02 21:44:07 +01:00
Daniel Winzen 22066309d5 Add login.defs file 2018-12-02 21:41:31 +01:00
Daniel Winzen 363d1b31ad Debian sid dropped php7.2 support - move to 7.3 only 2018-12-02 21:17:11 +01:00
Daniel Winzen 2e0e69d605 We don't need apt repository translations 2018-12-02 19:31:26 +01:00
Daniel Winzen 2149bc9fd8 update paragonie/sodium_compat dependency 2018-12-02 10:45:51 +01:00
Daniel Winzen 7111fa3a65 Prevent httpoxy vulnerability in PHP applications 2018-11-29 20:56:39 +01:00
Daniel WinzenandGitHub 921c43122c Merge pull request #35 from teikakki/patch-1 
Disabling emulated parameters
 2018-11-28 21:05:56 +01:00
Daniel Winzen 36fc7103cb Add hidden service v3 keygen and parser for base64 encoded secret keys 2018-11-25 14:36:28 +01:00
Daniel Winzen f0afbe14c9 Add sodium_compat composer dependency for v3 hidden_services 2018-11-24 14:56:24 +01:00
Daniel Winzen 9de11a9722 Dropped PHP7.1 support and install composer 2018-11-24 10:38:59 +01:00
Daniel Winzen 910381fee2 Removed php7.0 setup instructions 2018-11-19 21:23:34 +01:00
Daniel WinzenandGitHub 7d032f4955 Merge pull request #28 from jtesta/sshd_hardening 
Hardened SSH Service
 2018-11-19 21:20:43 +01:00
Daniel Winzen 41b33f2c51 Drop PHP7.0 support 2018-11-18 20:50:35 +01:00
Daniel Winzen db626a54a4 disable imap_open because of https://github.com/Bo0oM/PHP_imap_open_exploit 2018-11-17 10:15:15 +01:00
Daniel Winzen f4ca23336b Add clamav virus scan to mails 2018-11-11 11:17:20 +01:00
Daniel Winzen bb21f9f10b Reload disabled php versions since accounts can still be deleted 2018-10-28 09:31:00 +01:00
Daniel Winzen 5f3dfefa02 Drop now redundant config 2018-10-28 09:07:20 +01:00
Daniel Winzen b69293ab6d Dynamic supported versions on frontpage 2018-10-28 09:01:31 +01:00
Daniel Winzen 58b5efb96c Added suspend hidden service feature + disabled php7.0 for new accounts 2018-10-28 08:48:30 +01:00
Daniel Winzen 1884f4b08b php is .ini not .conf 2018-10-26 19:14:29 +02:00
Daniel Winzen 9985ba4864 Add PHP7.3 support and let setup.php write initial config files 2018-10-24 19:59:02 +02:00
Daniel Winzen d5d7078776 Allow editing hidden service options 2018-10-22 21:45:08 +02:00
Daniel Winzen b80f30ac03 Ignore insecure 777 permissions set by users on logrotate 2018-10-21 10:44:23 +02:00
Daniel Winzen cfb19915b5 Optimized find query to only search within each users tmp directory 2018-10-20 21:08:44 +02:00
Daniel Winzen d9e496930d Add HiddenServiceMaxStreams option and service_instances table 2018-10-20 20:44:10 +02:00
Daniel Winzen 2cee59dc6f Structure changes for future features 2018-10-20 18:20:27 +02:00
Daniel Winzen 96efd92ab1 bump dbversion 2018-10-17 21:51:20 +02:00
Daniel Winzen 1f2ff2176b Save DB information in separate table 2018-10-17 21:50:20 +02:00
Daniel Winzen 6eb068222c Refactor DB foreign keys to auto_incrementing id instead of onion 
Allows moving domains into separate table at a later stage
 2018-10-16 21:09:16 +02:00
Daniel Winzen 81c2364b7b Better load distribution on multiple relays 2018-09-23 20:09:04 +02:00
Daniel Winzen acc8782043 Add privacy policy checkbox (required by GDPR) 2018-09-10 19:30:12 +02:00
Daniel Winzen 382ea73efb Update firewall rules 2018-09-10 19:20:11 +02:00
Daniel Winzen 2c634b889c Add dnsmasq DNS caching and performance tune tor instances 2018-09-10 19:11:02 +02:00
Daniel Winzen 156a66a3ff Added missing php7.0-intl package 2018-09-10 19:06:51 +02:00
Daniel Winzen 1d157473e6 Move account folder creation into cron.php 2018-07-14 10:41:44 +02:00
Daniel Winzen f43e699b91 chroot postfix 2018-06-18 20:24:00 +02:00
Daniel Winzen e6d798370f secmail.pro dropped rewriting of .onion to .pro domain 2018-06-02 12:05:30 +02:00
Daniel Winzen 943ca4b151 Enable fastcgi_cache 2018-05-15 20:45:49 +02:00
Daniel Winzen dda49153b3 Buffer access log writes to reduce IO 2018-05-13 09:04:12 +02:00
Daniel Winzen 1a9ee646c6 Adapt firewall rule to new ftp ports 2018-05-06 09:57:24 +02:00
Daniel Winzen c6498ea1dc Increase available ports for passive ftp 2018-05-05 14:10:01 +02:00
Daniel Winzen 49a5b187b0 Increase buffer to get rid of errors on large response headers (e.g. cookies) 
upstream sent too big header while reading response header
 2018-04-22 15:07:00 +02:00
Daniel Winzen 300cd647df Increase limits and add putenv to disabled functions (vulerability) 
Potential security vulnerability:
<?php
putenv("LD_PRELOAD=/home/site.onion/libtest.so");
mail("test@localhost","hacked","you");
 2018-04-22 09:11:43 +02:00
Daniel Winzen c9487adb1a MariaDB hit open_files_limit -> increase it 2018-03-12 06:47:18 +01:00
Daniel Winzen e6ac79457f We have proper firewalling, fsockopen no longer needs to be disabled 2018-03-11 20:26:19 +01:00
Daniel Winzen b2fab1ec53 Fix /var/run/nginx not being created on nginx start 2018-03-11 20:17:14 +01:00
Daniel Winzen 7bd2e79f06 Separate nginx sockets for each site to make hoster identification harder 2018-03-08 20:57:42 +01:00
Daniel Winzen 9eb5c2ae3c Show error message on login when account has not yet been created 2018-03-03 19:22:57 +01:00
Daniel Winzen 47b9b6e3a6 Fixed db query 2018-02-26 16:37:35 +01:00
Daniel Winzen e8f8f42a24 Fix db query 2018-02-25 21:53:00 +01:00
Daniel Winzen 463be89b09 bumped database layout version 2018-02-25 21:47:29 +01:00
Daniel Winzen 6b0759be73 Added admin panel + optional manual approval for new sites 2018-02-25 21:25:05 +01:00
Daniel Winzen eca0c675cd Added missing dovecot config to use home maildir 2018-02-11 19:53:10 +01:00
Daniel Winzen ea112b3389 Added missing authorized destinations for services also reachable via .onion 2018-02-11 17:36:50 +01:00
Daniel Winzen 5163c7aa2b Connect to unix socket for default site 2018-02-11 17:22:31 +01:00
Daniel Winzen ee191ccbb8 PHP7.2 no longer has the mcrypt module as a package 2018-02-11 15:46:52 +01:00
Daniel Winzen fa24bb61ec Added PHP 7.2 support + minor bugfixes and performance tweaks 
Note when applying this update you will have to update existing nginx vhosts to match new listening addresses (IPv6). Preferably you should update them to unix socket though and apply the changes to the tor hidden service config as well
 2018-02-10 22:10:07 +01:00
Daniel Winzen c65055a9bb Set mysql host to % instead of localhost to allow connections to 127.0.0.1 
Note, for updating an existing database, you should run the following:
UPDATE mysql.user SET host='%'; FLUSH PRIVILEGES;
 2017-12-21 20:26:24 +01:00
Daniel Winzen 779c7bdaea Mentioned https://deb.sury.org/ debian php packaging 2017-12-07 18:05:24 +01:00