Skip to content

Commit 910c0de

Browse files
myreveryjaapmarcus
myrevery
and
jaapmarcus
authored
[Feature] Enhanced and Optimized TLS (hestiacp#3555)
* Enhanced and Optimized TLS * Prepare for installer and backup * Prepare for upgrade (easy part) * Prepare for upgrade (hell part) * Minor changes and Prettier * Changes for third-party compatibility * Issue in check --------- Co-authored-by: Jaap Marcus <9754650+jaapmarcus@users.noreply.github.com>
1 parent 27e6dbe commit 910c0de

File tree

19 files changed

+506
-255
lines changed

19 files changed

+506
-255
lines changed

‎func/upgrade.sh‎

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -271,6 +271,9 @@ upgrade_init_backup() {
271271
# Hestia Control Panel configuration files
272272
mkdir -p $HESTIA_BACKUP/conf/hestia/
273273

274+
# OpenSSL configuration files
275+
mkdir -p $HESTIA_BACKUP/conf/openssl/
276+
274277
# Hosting Packages
275278
mkdir -p $HESTIA_BACKUP/packages/
276279

@@ -352,12 +355,12 @@ upgrade_start_backup() {
352355
if [ "$DEBUG_MODE" = "true" ]; then
353356
echo " - Packages"
354357
fi
355-
cp -rf $HESTIA/data/packages/* $HESTIA_BACKUP/packages/
358+
cp -fr $HESTIA/data/packages/* $HESTIA_BACKUP/packages/
356359

357360
if [ "$DEBUG_MODE" = "true" ]; then
358361
echo " - Templates"
359362
fi
360-
cp -rf $HESTIA/data/templates/* $HESTIA_BACKUP/templates/
363+
cp -fr $HESTIA/data/templates/* $HESTIA_BACKUP/templates/
361364

362365
if [ "$DEBUG_MODE" = "true" ]; then
363366
echo " - Configuration files:"
@@ -367,7 +370,13 @@ upgrade_start_backup() {
367370
if [ "$DEBUG_MODE" = "true" ]; then
368371
echo " ---- hestia"
369372
fi
370-
cp -rf $HESTIA/conf/* $HESTIA_BACKUP/conf/hestia/
373+
cp -fr $HESTIA/conf/* $HESTIA_BACKUP/conf/hestia/
374+
375+
# OpenSSL configuration files
376+
if [ "$DEBUG_MODE" = "true" ]; then
377+
echo " ---- openssl"
378+
fi
379+
cp -f /etc/ssl/*.cnf $HESTIA_BACKUP/conf/openssl/
371380

372381
# System service configuration files (apache2, nginx, bind9, vsftpd, etc).
373382
if [ -n "$WEB_SYSTEM" ]; then
@@ -424,7 +433,6 @@ upgrade_start_backup() {
424433
if [ "$FTP_SYSTEM" = "vsftpd" ]; then
425434
cp -f /etc/$FTP_SYSTEM.conf $HESTIA_BACKUP/conf/$FTP_SYSTEM/
426435
fi
427-
428436
if [ "$FTP_SYSTEM" = "proftpd" ]; then
429437
cp -f /etc/proftpd/proftpd.conf $HESTIA_BACKUP/conf/$FTP_SYSTEM/
430438
fi
@@ -549,12 +557,12 @@ upgrade_b2_tool() {
549557

550558
upgrade_cloudflare_ip() {
551559
if [ "$WEB_SYSTEM" = "nginx" ] || [ "$PROXY_SYSTEM" = "nginx" ]; then
552-
cf_ips="$(curl -fsLm2 --retry 1 https://api.cloudflare.com/client/v4/ips)"
560+
cf_ips="$(curl -fsLm5 --retry 2 https://api.cloudflare.com/client/v4/ips)"
553561

554562
if [ -n "$cf_ips" ] && [ "$(echo "$cf_ips" | jq -r '.success//""')" = "true" ]; then
555563
cf_inc="/etc/nginx/conf.d/cloudflare.inc"
556564

557-
echo "[ * ] Updating Cloudflare IP Ranges for Nginx..."
565+
echo "[ * ] Updating Cloudflare IP Ranges for NGINX..."
558566
echo "# Cloudflare IP Ranges" > $cf_inc
559567
echo "" >> $cf_inc
560568
echo "# IPv4" >> $cf_inc

‎install/common/dovecot/conf.d/10-ssl.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
ssl = yes
2+
ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256
23
ssl_min_protocol = TLSv1.2
34
ssl_prefer_server_ciphers = yes
4-
ssl_cipher_list = ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
55

66
ssl_cert = </usr/local/hestia/ssl/certificate.crt
77
ssl_key = </usr/local/hestia/ssl/certificate.key

‎install/deb/exim/exim4.conf.4.94.template‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ tls_privatekey = \
6363

6464
daemon_smtp_ports = 25 : 465 : 587
6565
tls_on_connect_ports = 465
66+
tls_require_ciphers = PERFORMANCE:-RSA:-VERS-ALL:+VERS-TLS1.2:+VERS-TLS1.3:%SERVER_PRECEDENCE
6667
never_users = root
6768
host_lookup = *
6869
rfc1413_hosts = *

‎install/deb/exim/exim4.conf.template‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ tls_privatekey = \
6363

6464
daemon_smtp_ports = 25 : 465 : 587
6565
tls_on_connect_ports = 465
66+
tls_require_ciphers = PERFORMANCE:-RSA:-VERS-ALL:+VERS-TLS1.2:+VERS-TLS1.3:%SERVER_PRECEDENCE
6667
never_users = root
6768
host_lookup = *
6869
rfc1413_hosts = *

‎install/deb/nginx/nginx.conf‎

Lines changed: 29 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -22,19 +22,19 @@ http {
2222
client_body_timeout 180s;
2323
client_header_buffer_size 2k;
2424
client_body_buffer_size 256k;
25-
client_max_body_size 256m;
25+
client_max_body_size 1024m;
2626
large_client_header_buffers 4 8k;
2727
send_timeout 60s;
2828
keepalive_timeout 30s;
29-
keepalive_requests 100000;
29+
keepalive_requests 10000;
3030
reset_timedout_connection on;
3131
server_tokens off;
3232
server_name_in_redirect off;
3333
server_names_hash_max_size 512;
3434
server_names_hash_bucket_size 512;
3535
charset utf-8;
3636
# FastCGI settings
37-
fastcgi_buffers 8 256k;
37+
fastcgi_buffers 512 4k;
3838
fastcgi_buffer_size 256k;
3939
fastcgi_busy_buffers_size 256k;
4040
fastcgi_temp_file_write_size 256k;
@@ -51,14 +51,15 @@ http {
5151
proxy_set_header X-Real-IP $remote_addr;
5252
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
5353
proxy_pass_header Set-Cookie;
54-
proxy_buffers 32 4k;
55-
proxy_buffer_size 8k;
54+
proxy_buffers 256 4k;
55+
proxy_buffer_size 32k;
56+
proxy_busy_buffers_size 32k;
57+
proxy_temp_file_write_size 256k;
5658
proxy_connect_timeout 30s;
5759
proxy_read_timeout 300s;
5860
proxy_send_timeout 180s;
5961
# Log format
60-
log_format main '$remote_addr - $remote_user [$time_local] $request '
61-
'"$status" $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"';
62+
log_format main '$remote_addr - $remote_user [$time_local] $request "$status" $body_bytes_sent "$http_referer" "$http_user_agent" "$http_x_forwarded_for"';
6263
log_format bytes '$body_bytes_sent';
6364
log_not_found off;
6465
access_log off;
@@ -67,53 +68,46 @@ http {
6768
default_type application/octet-stream;
6869
# Compression
6970
gzip on;
70-
gzip_static on;
7171
gzip_vary on;
72+
gzip_static on;
7273
gzip_comp_level 6;
7374
gzip_min_length 1024;
74-
gzip_buffers 16 8k;
75+
gzip_buffers 128 4k;
7576
gzip_http_version 1.1;
76-
gzip_types text/plain text/css text/javascript text/js text/xml
77-
application/json application/javascript application/x-javascript application/xml
78-
application/xml+rss application/x-font-ttf image/svg+xml font/opentype;
77+
gzip_types text/css text/javascript text/js text/plain text/richtext text/shtml text/x-component text/x-java-source text/x-markdown text/x-script text/xml image/bmp image/svg+xml image/vnd.microsoft.icon image/x-icon font/otf font/ttf font/x-woff multipart/bag multipart/mixed application/eot application/font application/font-sfnt application/font-woff application/javascript application/javascript-binast application/json application/ld+json application/manifest+json application/opentype application/otf application/rss+xml application/ttf application/truetype application/vnd.api+json application/vnd.ms-fontobject application/wasm application/xhtml+xml application/xml application/xml+rss application/x-httpd-cgi application/x-javascript application/x-opentype application/x-otf application/x-perl application/x-protobuf application/x-ttf;
7978
gzip_proxied any;
80-
gzip_disable "MSIE [1-6]\.";
81-
82-
# Cloudflare ips
79+
# Cloudflare IPs
8380
include /etc/nginx/conf.d/cloudflare.inc;
84-
85-
# SSL PCI compliance
86-
ssl_session_cache shared:SSL:20m;
87-
ssl_session_timeout 60m;
88-
ssl_buffer_size 1400;
89-
ssl_protocols TLSv1.2 TLSv1.3;
90-
ssl_prefer_server_ciphers on;
91-
ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS";
81+
# SSL PCI compliance
82+
ssl_buffer_size 1369;
83+
ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256";
9284
ssl_dhparam /etc/ssl/dhparam.pem;
93-
ssl_ecdh_curve secp384r1;
94-
ssl_session_tickets off;
95-
resolver 1.1.1.1 8.8.8.8 valid=300s ipv6=off;
85+
ssl_early_data on;
86+
ssl_ecdh_curve auto;
87+
ssl_prefer_server_ciphers on;
88+
ssl_protocols TLSv1.2 TLSv1.3;
89+
ssl_session_cache shared:SSL:20m;
90+
ssl_session_tickets on;
91+
ssl_session_timeout 7d;
92+
resolver 1.0.0.1 8.8.4.4 1.1.1.1 8.8.8.8 valid=300s ipv6=off;
9693
resolver_timeout 5s;
9794
# Error pages
9895
error_page 403 /error/404.html;
9996
error_page 404 /error/404.html;
10097
error_page 410 /error/410.html;
10198
error_page 500 501 502 503 504 505 /error/50x.html;
10299
# Proxy cache
103-
proxy_cache_path /var/cache/nginx levels=2 keys_zone=cache:10m inactive=60m
104-
max_size=1024m;
100+
proxy_cache_path /var/cache/nginx levels=2 keys_zone=cache:10m inactive=60m max_size=1024m;
105101
proxy_cache_key "$scheme$request_method$host$request_uri";
106102
proxy_temp_path /var/cache/nginx/temp;
107-
proxy_ignore_headers Expires Cache-Control;
108-
proxy_cache_use_stale error timeout invalid_header http_502;
103+
proxy_ignore_headers Cache-Control Expires;
104+
proxy_cache_use_stale error timeout invalid_header updating http_502;
109105
proxy_cache_valid any 1d;
110106
# FastCGI cache
111-
fastcgi_cache_path /var/cache/nginx/micro levels=1:2 keys_zone=microcache:10m
112-
max_size=1024m inactive=30m;
107+
fastcgi_cache_path /var/cache/nginx/micro levels=1:2 keys_zone=microcache:10m inactive=30m max_size=1024m;
113108
fastcgi_cache_key "$scheme$request_method$host$request_uri";
114-
fastcgi_cache_methods GET HEAD;
115-
fastcgi_cache_use_stale updating error timeout invalid_header http_500 http_503;
116109
fastcgi_ignore_headers Cache-Control Expires Set-Cookie;
110+
fastcgi_cache_use_stale error timeout invalid_header updating http_500 http_503;
117111
add_header X-FastCGI-Cache $upstream_cache_status;
118112

119113
# Cache bypass
@@ -131,4 +125,4 @@ http {
131125
# Wildcard include
132126
include /etc/nginx/conf.d/*.conf;
133127
include /etc/nginx/conf.d/domains/*.conf;
134-
}
128+
}

‎install/deb/proftpd/tls.conf‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,9 @@
1313
TLSEngine on
1414
TLSLog /var/log/proftpd/tls.log
1515
# this is an example of protocols, proftp works witl all, but use only the most secure ones like TLSv1.1 and TLSv1.2
16-
TLSProtocol TLSv1.2
16+
TLSCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256
17+
TLSProtocol TLSv1.2 TLSv1.3
18+
TLSServerCipherPreference on
1719
#
1820
# Server SSL certificate. You can generate a self-signed certificate using
1921
# a command like:
@@ -42,9 +44,9 @@ TLSRSACertificateKeyFile /usr/local/hestia/ssl/certificate.key
4244
# Per default drop connection if client tries to start a renegotiate
4345
# This is a fix for CVE-2009-3555 but could break some clients.
4446
#
45-
#TLSOptions AllowClientRenegotiations
47+
#TLSOptions AllowClientRenegotiations
4648
#
47-
TLSOptions NoSessionReuseRequired AllowClientRenegotiations
49+
TLSOptions NoSessionReuseRequired AllowClientRenegotiations
4850
# Authenticate clients that want to use FTP over TLS?
4951
#
5052
#TLSVerifyClient off

‎install/deb/vsftpd/vsftpd.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ utf8_filesystem=YES
3131
ssl_enable=YES
3232
allow_anon_ssl=NO
3333
require_ssl_reuse=NO
34-
ssl_ciphers=ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256
34+
ssl_ciphers=ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256
3535
ssl_sslv2=NO
3636
ssl_sslv3=NO
3737
ssl_tlsv1=NO

‎install/hst-install-debian.sh‎

Lines changed: 27 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ software="acl apache2 apache2-suexec-custom apache2-suexec-pristine apache2-util
4949
php$fpm_v-pgsql php$fpm_v-pspell php$fpm_v-readline php$fpm_v-xml php$fpm_v-zip postgresql postgresql-contrib
5050
proftpd-basic quota rrdtool rsyslog spamassassin sudo sysstat unrar-free unzip util-linux vim-common vsftpd whois zip zstd"
5151

52-
installer_dependencies="apt-transport-https ca-certificates curl dirmngr gnupg wget"
52+
installer_dependencies="apt-transport-https ca-certificates curl dirmngr gnupg openssl wget"
5353

5454
# Defining help function
5555
help() {
@@ -685,7 +685,7 @@ if [ -z "$(swapon -s)" ] && [ "$memory" -lt 1000000 ]; then
685685
chmod 600 /swapfile
686686
mkswap /swapfile
687687
swapon /swapfile
688-
echo "/swapfile none swap sw 0 0" >> /etc/fstab
688+
echo "/swapfile none swap sw 0 0" >> /etc/fstab
689689
fi
690690

691691
#----------------------------------------------------------#
@@ -786,7 +786,10 @@ check_result $? 'apt-get upgrade failed'
786786
mkdir -p $hst_backups
787787
cd $hst_backups
788788
mkdir nginx apache2 php vsftpd proftpd bind exim4 dovecot clamd
789-
mkdir spamassassin mysql postgresql hestia
789+
mkdir spamassassin mysql postgresql openssl hestia
790+
791+
# Backup OpenSSL configuration
792+
cp /etc/ssl/openssl.cnf $hst_backups/openssl > /dev/null 2>&1
790793

791794
# Backup nginx configuration
792795
systemctl stop nginx > /dev/null 2>&1
@@ -799,7 +802,7 @@ rm -f /etc/apache2/conf.d/* > /dev/null 2>&1
799802

800803
# Backup PHP-FPM configuration
801804
systemctl stop php*-fpm > /dev/null 2>&1
802-
cp -r /etc/php/* $hst_backups/php/ > /dev/null 2>&1
805+
cp -r /etc/php/* $hst_backups/php > /dev/null 2>&1
803806

804807
# Backup Bind configuration
805808
systemctl stop bind9 > /dev/null 2>&1
@@ -1261,6 +1264,22 @@ cp -rf $HESTIA_COMMON_DIR/api $HESTIA/data/
12611264
# Configuring server hostname
12621265
$HESTIA/bin/v-change-sys-hostname $servername > /dev/null 2>&1
12631266

1267+
# Configuring global OpenSSL options
1268+
echo "[ * ] Configuring OpenSSL to improve TLS performance..."
1269+
tls13_ciphers="TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384"
1270+
if [ "$release" = "10" ] || [ "$release" = "11" ]; then
1271+
sed -i '/^system_default = system_default_sect$/a system_default = hestia_openssl_sect\n\n[hestia_openssl_sect]\nCiphersuites = '"$tls13_ciphers"'\nOptions = PrioritizeChaCha' /etc/ssl/openssl.cnf
1272+
elif [ "$release" = "12" ]; then
1273+
if ! grep -qw "^ssl_conf = ssl_sect$" /etc/ssl/openssl.cnf 2> /dev/null; then
1274+
sed -i '/providers = provider_sect$/a ssl_conf = ssl_sect' /etc/ssl/openssl.cnf
1275+
fi
1276+
if ! grep -qw "^[ssl_sect]$" /etc/ssl/openssl.cnf 2> /dev/null; then
1277+
sed -i '$a \\n[ssl_sect]\nsystem_default = hestia_openssl_sect\n\n[hestia_openssl_sect]\nCiphersuites = '"$tls13_ciphers"'\nOptions = PrioritizeChaCha' /etc/ssl/openssl.cnf
1278+
elif grep -qw "^system_default = system_default_sect$" /etc/ssl/openssl.cnf 2> /dev/null; then
1279+
sed -i '/^system_default = system_default_sect$/a system_default = hestia_openssl_sect\n\n[hestia_openssl_sect]\nCiphersuites = '"$tls13_ciphers"'\nOptions = PrioritizeChaCha' /etc/ssl/openssl.cnf
1280+
fi
1281+
fi
1282+
12641283
# Generating SSL certificate
12651284
echo "[ * ] Generating default self-signed SSL certificate..."
12661285
$HESTIA/bin/v-generate-ssl-cert $(hostname) '' 'US' 'California' \
@@ -1335,12 +1354,12 @@ for ip in $dns_resolver; do
13351354
fi
13361355
done
13371356
if [ -n "$resolver" ]; then
1338-
sed -i "s/1.1.1.1 8.8.8.8/$resolver/g" /etc/nginx/nginx.conf
1339-
sed -i "s/1.1.1.1 8.8.8.8/$resolver/g" /usr/local/hestia/nginx/conf/nginx.conf
1357+
sed -i "s/1.0.0.1 8.8.4.4 1.1.1.1 8.8.8.8/$resolver/g" /etc/nginx/nginx.conf
1358+
sed -i "s/1.0.0.1 8.8.4.4 1.1.1.1 8.8.8.8/$resolver/g" /usr/local/hestia/nginx/conf/nginx.conf
13401359
fi
13411360

13421361
# https://github.com/ergin/nginx-cloudflare-real-ip/
1343-
cf_ips="$(curl -fsLm2 --retry 1 https://api.cloudflare.com/client/v4/ips)"
1362+
cf_ips="$(curl -fsLm5 --retry 2 https://api.cloudflare.com/client/v4/ips)"
13441363

13451364
if [ -n "$cf_ips" ] && [ "$(echo "$cf_ips" | jq -r '.success//""')" = "true" ]; then
13461365
cf_inc="/etc/nginx/conf.d/cloudflare.inc"
@@ -1479,7 +1498,7 @@ if [ "$vsftpd" = 'yes' ]; then
14791498
touch /var/log/xferlog
14801499
chown root:adm /var/log/xferlog
14811500
chmod 640 /var/log/xferlog
1482-
update-rc.d vsftpd defaults
1501+
update-rc.d vsftpd defaults > /dev/null 2>&1
14831502
systemctl start vsftpd >> $LOG
14841503
check_result $? "vsftpd start failed"
14851504
fi

0 commit comments

Comments
 (0)