Skip to content

Commit 7d8c631

Browse files
author
Kristan Kenney
committed
Merge branch 'security/tls'
2 parents 40b5a2a + 9710e08 commit 7d8c631

File tree

9 files changed

+71
-30
lines changed

9 files changed

+71
-30
lines changed

‎install/deb/dovecot/conf.d/10-ssl.conf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
ssl = yes
22
ssl_protocols = !SSLv3 !TLSv1
3+
ssl_prefer_server_ciphers = yes
4+
ssl_cipher_list = ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
35

46
ssl_cert = </usr/local/hestia/ssl/certificate.crt
57
ssl_key = </usr/local/hestia/ssl/certificate.key
8+
ssl_dh = </etc/ssl/dhparam.pem

‎install/deb/ssl/dhparam.pem‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
-----BEGIN DH PARAMETERS-----
2-
MIICCAKCAgEA+tQGpIebOZgTRfzeJO8V08AKJxjIEPl+ks2s0kVcYEYn7XhoqV9p
3-
vMxYxSz+3gavaKD42tbxbru01MZhi6PAhvWZn1pUgdUFTDPv6Suq/zQuNvxEx/p4
4-
/TvfQ+6IqWcPFjGZb6lmnR4v592joEmTaps6Uqv2PDqCgZoeLDqVSsqWRotFbFWa
5-
mHCFU/5RsSyUAPhuH9lk0UOnK+rkQulppZsAKNLMUBSoNGg+OjYbvcRq8WMQIx8H
6-
Or8i9lZa12UFfr3ui5I7Y29aARh4M8WTtWKAxoDp6N8ENT3hXqgEm4cIVmHOgFDZ
7-
SvWvsV/6ghDpYIOgiatKauQPd2wXkZ/95yeO2JxyYS9rGK4a10QICsB/Jj5j/1i8
8-
yimrllUs5UW8BjmkRTYQPFtvZzrYUoSohSazz7r5Q7/K/Nh40Tb+SgGvQqMxTolL
9-
nTR2kP8DDpTIar/E2B1fDM+yk07hMmKlTOP+nFmJtcq61rM79kQfpsG4mxIX2sxR
10-
el6qP5ng8NQG648aL9OnaUgisLpz1ll6cL7rXHExxEiFgb667F+uKVYJ31d0KyBE
11-
6zrb7iIr5l1q+/vIxIu3QvOfH43+lAV/XHaNP1YvrCkTmkihBAeHt74x5uZRalg3
12-
3qci/XOL0h6i5YW3s7Yem1tqy04P2XYVfmfr4KzzNjOFAQwADKm7G3sCAQI=
13-
-----END DH PARAMETERS-----
2+
MIICCAKCAgEA7N3ZOcXgACR0Rat9G/7h8krD7ysVvmEmvAdg8o5l7eKVdtp/QSNK
3+
anF0JyInJMBEgq05GY7YwvFovglJL73T/eEjTK3qPU6eHzxNGKfR0pM6rnAb+EXL
4+
dSNJm3Xz9wH4IKn6OJ3nD9aLmBVI5FlIMV1R4QKX3sIWUxRqRSQIzjNQTnY1e/Pk
5+
BT/ZrUUF7fPPVbg0nPD8Y48ISr7pB6M14Kr66cggGIqUVdBdkPYyt4RpFWR1n3Tv
6+
rz1j0U+UoVnan2FgGsSiSFT9I/CiIxgC/SrdwxZLUgbAiKsnw9H7nGW92C4cRqY0
7+
2eKMVNEBk32GSPQXaA+Q5TILyzxuwDbXMxHMxnUVKQGFEcXjWXXyiv7tLAeu68Do
8+
j5iNFOHbDp17SftnxYHi2vTsYk+9K6Pzc+NmUgibM52Rs92PPYd++HcgMeGrYcqi
9+
temHP2jPtAymixch0wdqBMgeGTb29w51LR0BAU6D6BeR25pkZvPUag3bb6SU1Oli
10+
E15DDWh3UnmfTw2M9W1uxlzQAlXOLL6/ZWuvwyqhCY6X7tIONtSgdYGjtiTFaPJp
11+
ZBdOOrblodLxSu0ObR59SFjv8Pz3sTw4xiRFTG3lFtuIVHdBUbtJHR+2p4fHy/JG
12+
Ccs+Z1KrmJfEzSMzKwfvZYJ526demNulglFBbcQV06ehqjc6MCG3HnMCAQI=
13+
-----END DH PARAMETERS-----

‎install/deb/vsftpd/vsftpd.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ ssl_enable=YES
3232
allow_anon_ssl=NO
3333
require_ssl_reuse=NO
3434
ssl_ciphers=HIGH
35-
ssl_tlsv1=YES
35+
ssl_tlsv1=NO
3636
ssl_sslv2=NO
3737
ssl_sslv3=NO
3838
force_local_data_ssl=NO

‎install/hst-install-ubuntu.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1163,6 +1163,7 @@ if [ "$nginx" = 'yes' ]; then
11631163
done
11641164
if [ ! -z "$resolver" ]; then
11651165
sed -i "s/1.0.0.1 1.1.1.1/$resolver/g" /etc/nginx/nginx.conf
1166+
sed -i "s/1.0.0.1 1.1.1.1/$resolver/g" /usr/local/hestia/nginx/conf/nginx.conf
11661167
fi
11671168

11681169
update-rc.d nginx defaults > /dev/null 2>&1

‎install/upgrade/restart.sh‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,9 @@ for v in `ls /etc/php/`; do
3333
$BIN/v-restart-service php$v-fpm $restart
3434
fi
3535
done
36+
if [ ! -z $FTP_SYSTEM ]; then
37+
$BIN/v-restart-ftp $restart
38+
fi
3639

3740
# Restart SSH daemon and Hestia Control Panel service
3841
$BIN/v-restart-service ssh $restart

‎install/upgrade/versions/1.0.3.sh‎

Lines changed: 0 additions & 14 deletions
This file was deleted.

‎install/upgrade/versions/1.0.5.sh‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
#!/bin/sh
2+
3+
# Hestia Control Panel upgrade script for target version 1.0.5
4+
5+
#######################################################################################
6+
####### Place additional commands below. #######
7+
#######################################################################################
8+
9+
# Set default theme
10+
if [ -z $THEME ]; then
11+
echo "(*) Enabling support for themes..."
12+
$BIN/v-change-sys-theme default
13+
fi
14+
15+
# Replace dhparam 1024 with dhparam 4096
16+
echo "(*) Installing 4096-bit SSL security certificate..."
17+
mv /etc/ssl/dhparam.pem $HESTIA_BACKUP/conf/
18+
cp -rf $HESTIA/install/deb/ssl/dhparam.pem /etc/ssl/
19+
chmod 600 /etc/ssl/dhparams.pem
20+
21+
# Enhance Vsftpd security
22+
echo "(*) Modifying Vsftpd SSL configuration..."
23+
cp -rf /etc/vsftpd.conf $HESTIA_BACKUP/conf/
24+
sed -i "s|ssl_tlsv1=YES|ssl_tlsv1=NO|g" /etc/vsftpd.conf
25+
26+
# Enhance Dovecot security
27+
echo "(*) Modifying Dovecot SSL configuration..."
28+
mv /etc/dovecot/conf.d/10-ssl.conf $HESTIA_BACKUP/conf/
29+
cp -rf $HESTIA/install/deb/dovecot/10-ssl.conf /etc/dovecot/conf.d/
30+
31+
# Update DNS resolvers in hestia-nginx's configuration
32+
echo "(*) Updating DNS resolvers for Hestia Internal Web Server..."
33+
dns_resolver=$(cat /etc/resolv.conf | grep -i '^nameserver' | cut -d ' ' -f2 | tr '\r\n' ' ' | xargs)
34+
for ip in $dns_resolver; do
35+
if [[ $ip =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
36+
resolver="$ip $resolver"
37+
fi
38+
done
39+
if [ ! -z "$resolver" ]; then
40+
sed -i "s/1.0.0.1 1.1.1.1/$resolver/g" /usr/local/hestia/nginx/conf/nginx.conf
41+
fi

‎src/deb/nginx/nginx.conf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,8 +82,16 @@ http {
8282
ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
8383
ssl_prefer_server_ciphers on;
8484
ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS";
85+
ssl_dhparam /etc/ssl/dhparam.pem;
86+
ssl_ecdh_curve secp384r1;
87+
ssl_session_tickets off;
88+
resolver 1.0.0.1 1.1.1.1 valid=300s ipv6=off;
89+
resolver_timeout 5s;
90+
ssl_stapling on;
91+
ssl_stapling_verify on;
8592
add_header X-Frame-Options SAMEORIGIN;
8693
add_header X-Content-Type-Options nosniff;
94+
add_header X-XSS-Protection "1; mode=block";
8795

8896
# Vhost
8997
server {

‎src/hst_autocompile.sh‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ fi
8787
BUILD_ARCH='amd64'
8888
HESTIA_V="${BUILD_VER}_${BUILD_ARCH}"
8989
NGINX_V=$(curl -s https://raw.githubusercontent.com/hestiacp/hestiacp/$branch/src/deb/nginx/control |grep "Version:" |cut -d' ' -f2)
90-
OPENSSL_V='1.1.1b'
90+
OPENSSL_V='1.1.1c'
9191
PCRE_V='8.43'
9292
ZLIB_V='1.2.11'
9393
PHP_V=$(curl -s https://raw.githubusercontent.com/hestiacp/hestiacp/$branch/src/deb/php/control |grep "Version:" |cut -d' ' -f2)
@@ -287,8 +287,7 @@ if [ "$NGINX_B" = true ] ; then
287287
else
288288
cp $BUILD_DIR/hestiacp-$branch/src/deb/nginx/nginx.conf "usr/local/hestia/nginx/conf/nginx.conf"
289289
fi
290-
291-
290+
292291
# copy binary
293292
cp usr/local/hestia/nginx/sbin/nginx usr/local/hestia/nginx/sbin/hestia-nginx
294293

0 commit comments

Comments
 (0)