Skip to content

Commit c6f4462

Browse files
author
Kristan Kenney
committed
Add 1.0.2's instructions to archive and remove duplicate entries from 1.0.3
1 parent c7701b6 commit c6f4462

File tree

2 files changed

+82
-59
lines changed

2 files changed

+82
-59
lines changed

‎install/upgrade/versions/latest.sh‎

Lines changed: 6 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -12,77 +12,24 @@ if [ -z $THEME ]; then
1212
$BIN/v-change-sys-theme default
1313
fi
1414

15-
# Replace dhparam 1024 with dhparam 4096
16-
echo "(*) Increasing Diffie-Hellman Parameter strength to 4096-bit..."
17-
if [ -e /etc/ssl/dhparam.pem ]; then
18-
mv /etc/ssl/dhparam.pem $HESTIA_BACKUP/conf/
19-
fi
20-
cp -f $HESTIA_INSTALL_DIR/ssl/dhparam.pem /etc/ssl/
21-
chmod 600 /etc/ssl/dhparam.pem
22-
2315
# Reduce SSH login grace time
2416
echo "(*) Hardening SSH daemon configuration..."
2517
sed -i "s/LoginGraceTime 2m/LoginGraceTime 1m/g" /etc/ssh/sshd_config
2618
sed -i "s/#LoginGraceTime 2m/LoginGraceTime 1m/g" /etc/ssh/sshd_config
2719

28-
# Enhance Vsftpd security
29-
if [ "$FTP_SYSTEM" = "vsftpd" ]; then
30-
echo "(*) Hardening Vsftpd SSL configuration..."
31-
cp -f /etc/vsftpd.conf $HESTIA_BACKUP/conf/
32-
sed -i "s|ssl_tlsv1=YES|ssl_tlsv1=NO|g" /etc/vsftpd.conf
33-
fi
34-
35-
# Enhance Dovecot security
36-
if [ "$IMAP_SYSTEM" = "dovecot" ]; then
37-
echo "(*) Hardening Dovecot SSL configuration..."
38-
mv /etc/dovecot/conf.d/10-ssl.conf $HESTIA_BACKUP/conf/
39-
cp -f $HESTIA_INSTALL_DIR/dovecot/conf.d/10-ssl.conf /etc/dovecot/conf.d/
40-
fi
41-
# Update DNS resolvers in hestia-nginx's configuration
42-
echo "(*) Updating DNS resolvers for Hestia Internal Web Server..."
43-
dns_resolver=$(cat /etc/resolv.conf | grep -i '^nameserver' | cut -d ' ' -f2 | tr '\r\n' ' ' | xargs)
44-
for ip in $dns_resolver; do
45-
if [[ $ip =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
46-
resolver="$ip $resolver"
47-
fi
48-
done
49-
if [ ! -z "$resolver" ]; then
50-
sed -i "s/1.0.0.1 1.1.1.1/$resolver/g" /usr/local/hestia/nginx/conf/nginx.conf
51-
fi
52-
53-
# Remove Webalizer and set AWStats as default
54-
WEBALIZER_CHECK=$(cat $HESTIA/conf/hestia.conf | grep webalizer)
55-
if [ ! -z "$WEBALIZER_CHECK" ]; then
56-
echo "(*) Removing Webalizer and setting AWStats as default web statistics backend..."
57-
apt purge webalizer -y > /dev/null 2>&1
58-
if [ -d "$HESTIA/data/templates/web/webalizer" ]; then
59-
rm -rf $HESTIA/data/templates/web/webalizer
60-
fi
61-
if [ -d "/var/www/webalizer" ]; then
62-
rm -rf /var/www/webalizer
63-
fi
64-
$HESTIA/bin/v-change-sys-config-value 'STATS_SYSTEM' 'awstats'
65-
fi
66-
67-
# Remove old hestia.conf files from Apache & NGINX if they exist
68-
if [ -f "/etc/apache2/conf.d/hestia.conf" ]; then
69-
echo "(*) Removing old Apache configuration file from previous version of Hestia Control Panel..."
70-
rm -f /etc/apache2/conf.d/hestia.conf
71-
fi
72-
if [ -f "/etc/nginx/conf.d/hestia.conf" ]; then
73-
echo "(*) Removing old NGINX configuration file from previous version of Hestia Control Panel..."
74-
rm -f /etc/nginx/conf.d/hestia.conf
75-
fi
76-
7720
# Implement recidive jail for fail2ban
7821
if [ ! -z "$FIREWALL_EXTENSION" ]; then
7922
if ! cat /etc/fail2ban/jail.local | grep -q "recidive"; then
8023
echo -e "\n\n[recidive]\nenabled = true\nfilter = recidive\naction = hestia[name=HESTIA]\nlogpath = /var/log/fail2ban.log\nmaxretry = 3\nfindtime = 86400\nbantime = 864000" >> /etc/fail2ban/jail.local
8124
fi
8225
fi
8326

84-
# Update webmail templates to enable OCSP/SSL stapling
27+
# Enable OCSP SSL stapling and harden nginx configuration for roundcube
8528
if [ ! -z "$IMAP_SYSTEM" ]; then
86-
echo "(*) Improving SSL security of Roundcube webmail..."
29+
echo "(*) Hardening security of Roundcube webmail..."
8730
$BIN/v-update-mail-templates > /dev/null 2>&1
31+
if [ -e /etc/nginx/conf.d/webmail.inc ]; then
32+
cp -f /etc/nginx/conf.d/webmail.inc $HESTIA_BACKUP/conf/
33+
sed -i "s/config|temp|logs/README.md|config|temp|logs|bin|SQL|INSTALL|LICENSE|CHANGELOG|UPGRADING/g" /etc/nginx/conf.d/webmail.inc
34+
fi
8835
fi

‎install/upgrade/versions/previous/1.0.2.sh‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,79 @@
55
#######################################################################################
66
####### Place additional commands below. #######
77
#######################################################################################
8+
9+
#!/bin/sh
10+
11+
# Hestia Control Panel upgrade script for target version 1.0.2
12+
13+
#######################################################################################
14+
####### Place additional commands below. #######
15+
#######################################################################################
16+
17+
# Replace dhparam 1024 with dhparam 4096
18+
echo "(*) Increasing Diffie-Hellman Parameter strength to 4096-bit..."
19+
if [ -e /etc/ssl/dhparam.pem ]; then
20+
mv /etc/ssl/dhparam.pem $HESTIA_BACKUP/conf/
21+
fi
22+
cp -f $HESTIA/install/deb/ssl/dhparam.pem /etc/ssl/
23+
chmod 600 /etc/ssl/dhparam.pem
24+
25+
# Enhance Vsftpd security
26+
if [ "$FTP_SYSTEM" = "vsftpd" ]; then
27+
echo "(*) Hardening Vsftpd SSL configuration..."
28+
cp -f /etc/vsftpd.conf $HESTIA_BACKUP/conf/
29+
sed -i "s|ssl_tlsv1=YES|ssl_tlsv1=NO|g" /etc/vsftpd.conf
30+
fi
31+
32+
# Enhance Dovecot security
33+
if [ "$IMAP_SYSTEM" = "dovecot" ]; then
34+
echo "(*) Hardening Dovecot SSL configuration..."
35+
mv /etc/dovecot/conf.d/10-ssl.conf $HESTIA_BACKUP/conf/
36+
cp -f $HESTIA/install/deb/dovecot/conf.d/10-ssl.conf /etc/dovecot/conf.d/
37+
fi
38+
39+
# Update DNS resolvers in hestia-nginx's configuration
40+
echo "(*) Updating DNS resolvers for Hestia Internal Web Server..."
41+
dns_resolver=$(cat /etc/resolv.conf | grep -i '^nameserver' | cut -d ' ' -f2 | tr '\r\n' ' ' | xargs)
42+
for ip in $dns_resolver; do
43+
if [[ $ip =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
44+
resolver="$ip $resolver"
45+
fi
46+
done
47+
if [ ! -z "$resolver" ]; then
48+
sed -i "s/1.0.0.1 1.1.1.1/$resolver/g" /usr/local/hestia/nginx/conf/nginx.conf
49+
fi
50+
51+
# Remove Webalizer and set AWStats as default
52+
WEBALIZER_CHECK=$(cat $HESTIA/conf/hestia.conf | grep webalizer)
53+
if [ ! -z "$WEBALIZER_CHECK" ]; then
54+
echo "(*) Removing Webalizer and setting AWStats as default web statistics backend..."
55+
apt purge webalizer -y > /dev/null 2>&1
56+
if [ -d "$HESTIA/data/templates/web/webalizer" ]; then
57+
rm -rf $HESTIA/data/templates/web/webalizer
58+
fi
59+
if [ -d "/var/www/webalizer" ]; then
60+
rm -rf /var/www/webalizer
61+
fi
62+
$HESTIA/bin/v-change-sys-config-value '$STATS_SYSTEM' 'awstats'
63+
fi
64+
65+
# Remove old hestia.conf files from Apache & NGINX if they exist
66+
if [ -f "/etc/apache2/conf.d/hestia.conf" ]; then
67+
echo "(*) Removing old Apache configuration file from previous version of Hestia Control Panel..."
68+
rm -f /etc/apache2/conf.d/hestia.conf
69+
fi
70+
if [ -f "/etc/nginx/conf.d/hestia.conf" ]; then
71+
echo "(*) Removing old NGINX configuration file from previous version of Hestia Control Panel..."
72+
rm -f /etc/nginx/conf.d/hestia.conf
73+
fi
74+
75+
# Update webmail templates to enable OCSP/SSL stapling
76+
if [ ! -z "$IMAP_SYSTEM" ]; then
77+
echo "(*) Enabling OCSP stapling support for webmail services..."
78+
$BIN/v-update-mail-templates > /dev/null 2>&1
79+
fi
80+
81+
# Enhance webmail security
82+
cp -f /etc/nginx/conf.d/webmail.inc $HESTIA_BACKUP/conf/
83+
sed -i "s/config|temp|logs/README.md|config|temp|logs|bin|SQL|INSTALL|LICENSE|CHANGELOG|UPGRADING/g" /etc/nginx/conf.d/webmail.inc

0 commit comments

Comments
 (0)