elitepvpers
Page 8 of 12 « First 67 8 910 Last »
Show 40 post(s) from this thread on one page

elitepvpers (https://www.elitepvpers.com/forum/)
-   Unix/Linux (https://www.elitepvpers.com/forum/unix-linux/)
-   -   Der perfekte Rootserver (Support Thread) (https://www.elitepvpers.com/forum/unix-linux/3955384-der-perfekte-rootserver-support-thread.html)

TiggaStyle 06/27/2016 09:54
nginx hat ne neue version, 1.10 oder schon 1.11

aber das script hat sein eigenes nginx somit wird es einfach nicht upgedatet über die paket quellen.

TakeThisBitch 06/27/2016 10:00
Achso, also müsste man nginx manuell updaten? Gibt es dabei etwas speziell zu beachten? Sonst würde ich wie im Script vorgehen

Gesendet von meinem C6903 mit Tapatalk

TiggaStyle 06/27/2016 15:21
könnte man, is aber glaube ich kein muss.

TakeThisBitch 06/27/2016 15:37
Was wäre der sinnvollste weg.eines updates?

Gesendet von meinem C6903 mit Tapatalk

Hat mail bzw dovecot kein Spamschutz?

Ich habe über 60.000 Einträge die exact so aussehen:
Spoiler:
Code:
Jun 26 19:55:59 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:56:00 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:56:00 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:56:01 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:56:01 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:56:02 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:56:02 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:56:02 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:56:03 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:56:03 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:56:04 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:56:04 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:56:05 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:56:05 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:56:06 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:56:06 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:56:07 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:56:07 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:57:46 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:57:46 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:57:47 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:57:47 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:57:48 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:57:48 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:57:49 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:57:49 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:57:50 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:57:50 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:57:50 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:57:51 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:57:52 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:57:52 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:57:53 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:57:53 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:57:53 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:57:54 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:57:54 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:57:55 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:57:55 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:57:56 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:57:56 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 19:57:57 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:00:07 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:00:07 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:00:08 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:00:08 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:00:09 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:00:09 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:00:10 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:00:10 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:00:10 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:00:11 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:00:11 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:00:12 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:00:12 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:00:13 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:00:13 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:00:14 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:00:14 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:00:15 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:00:15 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:00:15 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:00:16 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:00:16 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:00:17 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:00:17 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:01:51 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:01:51 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:01:52 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:01:52 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:01:53 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:01:53 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:01:53 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:01:54 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:01:54 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:01:55 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:01:55 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:01:56 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:01:56 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:01:57 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:01:57 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:01:58 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:01:58 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:01:58 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:01:59 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:01:59 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:02:00 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:02:00 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:02:01 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:02:01 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:02:07 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:02:07 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:02:08 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:02:08 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:02:09 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:02:09 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:02:10 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:02:10 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:02:10 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:02:11 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:02:11 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:02:12 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:02:12 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:02:13 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21
Jun 26 20:02:13 mail dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67.86.239.172, lip=188.68.55.21

67.86.239.172 kommt wohl aus new york / Brooklyn
188.68.55.21 ist wohl eine Russische IP

TiggaStyle 06/29/2016 11:20
eigentlich sollte der fail2ban das abfangen.

TakeThisBitch 06/29/2016 11:21
Tut es aber irgendwie nicht. Muss ich mal schauen was ich wie dagegen machen kann u d vorallem wieso fail2ban das nicht selbst macht

Gesendet von meinem C6903 mit Tapatalk

REtender 07/08/2016 15:42
Falls es wer braucht / testen mag bzw. Anregungen hat:
[Only registered and activated users can see links. Click Here To Register...]

Ich habe einen Fork erstellt und ein paar Sachen geändert wie
- Verisign durch den Google DNS ausgetauscht
- rc.local "Fehler" gefixt
- man kann Teamspeak 3 nun installieren!
- mc wird nun auto installiert

In Zukunft möchte ich vll noch mehr Programme einbauen die man auswählen kann, dass ist eine gute Möglichkeit um sich mit Linux auseinander zu setzen :P

Ich hoffe das ist für Zypr okay :)

TakeThisBitch 07/08/2016 15:47
Klingt gut. Werde es mal testen die tage.

Gesendet von meinem C6903 mit Tapatalk

_daniel4711 07/09/2016 08:47
Kann man in der userconfig auch 2 Domain Adressen angeben?

TakeThisBitch 07/09/2016 08:48
Sollte nicht möglich sein

Gesendet von meinem C6903 mit Tapatalk

REtender 07/12/2016 01:12
Quote:
Originally Posted by TakeThisBitch (Post 34634414)
z.B. habe ich die Spielwiese vorhin neu aufgesetzt. Wieder Debian 8 so wie davor auch. Nur diesmal wurde beim bzw. nach dem erstellen des ssl Zertifikats gesagt, dass die .pem file nicht gefunden wurde.

Also nochmal neu aufgesetzt und siehe da, jetzt wieder:
Code:
[..]
[20:13:27] | [INFO] Creating valid SSL certificates...
sources/script/functions.sh: line 627: /etc/nginx/ssl/meine-domain.de.pem: No such file or directory
unable to load Public Key
[20:16:22] | [INFO] Creating strong Diffie-Hellman parameters, please wait...
Da ich gerade mit meinem Fork rumspiele installiere ich regelmäßig meine Spielwiese neu...
Ich bekomme mit den Original und meinem Script den Fehler und die Domain steht definitiv klein in der Config :D

Der Wurm ist wohl bei ./letsencrypt-auto
... es wird kein /etc/letsencrypt/live/${MYDOMAIN}/fullchain.pem angelegt, daher wird auch kein gültiger Link erzeugt...
ergo lädt er den public Key nicht
Nun ist die Frage wieso das ab und an auftritt... vielleicht wenn man zu oft an einem Tag ein Cert anfordert bzw. dauert es dann mal länger?

TakeThisBitch 07/12/2016 08:07
Nein, das kann eigentlich nicht sein, weil es keine laufzeitbegrenzung gibt. Auch lets encrypt hat nur eine Limitierung von der Anzahl der Zertifikate pro domain á 7 Tage soweit ich weiß.

Ich werd da auch nochmal was prüfen.

Mal ne Frage zum Zertifikat :
Wird das automatisch erneuert? Habe nämlich eine Mail bekommen, dass die Zertifikate heute auslaufen und ich die erneuern soll.

Dachte der.cron geht ein paar.tage vor auslaufen der Zertifikate los.

Gesendet von meinem C6903 mit Tapatalk

Hello,

Your certificate (or certificates) for the names listed below will expire in 1 days (on 12 Jul 16 19:31 +0000). Please make sure to renew your certificate before then, or visitors to your website will encounter errors.

autoconfig.domain.de
autodiscover.domain.de
mail.domain.de
[Only registered and activated users can see links. Click Here To Register...]
Domain.de

For any questions or support, please visithttps://community.letsencrypt.org/. Unfortunately, we can't provide support by email.


=--------------------------------------------=

Achso, was meiner Meinung nach im Script fehlt sind nen paar moderne serverüberwachungsmethoden.

Z.b. Bei übermäßig viel traffic.

Außerdem kann man nach der Installation doch einen oder mehrere hashwerte der Ordner erstellen. Ausgenommen log Ordner oder sonstige dynamische Inhalte.

Installiert man dann eine Seite oder macht was, generiert man die "sauberen" hashwerte neu. Auch nach einem update und.upgrade.

Sollte sich dann irgendwann mal doch maleware unterjubeln sollte man in einer wöchentlichen hashprüfung das.erkennen.


Gesendet von meinem C6903 mit Tapatalk

REtender 07/12/2016 11:56
Quote:
20 certificates per registered domain per week (up from 5).
Added an exception to this limit for renewing certificates (issuing a new certificate with same names as a previous one).
Added a new limit on issuing certificates with the exact same set of names: 5 certificates per FQDN set per week.
Das wird es wohl sein... gut zu wissen das es da ein Limit gibt :D
Gut dann wird die Spielwiese erstmal nur ein selbst erstelltes Zertifikat haben.

TakeThisBitch 07/12/2016 12:24
Hat das Script eine Methode zum erneuern der Zertifikate?

Wie kann ich die erneuern?

Gesendet von meinem C6903 mit Tapatalk

TiggaStyle 07/12/2016 12:56
ich weiß grade nicht wo letsencrypt liegt, aber es gibt die funktion letsencrypt --renew

Tulskie 07/15/2016 19:16
Quote:
Originally Posted by Zypr (Post 21384884)
Der perfekte Rootserver

Version 0.3.8


Was kann das Skript?:

Das Zertifikat von Let's Encrypt ist aktuell nur 3 Monate gültig, deshalb muss es ca. alle 80 Tage neu validiert werden. Let's Encrypt ansich findet man hier:

Code:
/root/sources/letsencrypt

So erstellt/erneutert man sein Zertifikat:

In den Ordner navigieren:

Code:
cd ~/sources/letsencrypt
Jetzt kann man ein neues Zertifikat erstellen. Let's Encrypt bietet zwar keine Wildcard Zertifikate an, unterstützt aber meines Wissens nach beliebig viele Subdomains.

Code:
Wenn der Mailserver genutzt wird:
./letsencrypt-auto --agree-tos --renew-by-default --email [Only registered and activated users can see links. Click Here To Register...] --rsa-key-size 4096 -d deinedomain.tld -d www.deinedomain.tld -d mail.deinedomain.tld -d autodiscover.deinedomain.tld -d autoconfig.deinedomain.tld -d dav.deinedomain.tld certonly

Wenn der Mailserver nicht genutzt wird:
./letsencrypt-auto --agree-tos --renew-by-default --email [Only registered and activated users can see links. Click Here To Register...] --rsa-key-size 4096 -d deinedomain.tld -d www.deinedomain.tld certonly
Die E-Mail ist wichtig, damit man bei Verlust seine Daten wiederbekommt.


Zypr
Bitteschön

REtender 07/17/2016 02:47
Ich habe den Script nochmal erweitert und man kann neben Teamspeak 3 nun auch Ajenti installieren :)

Es sollte alles funktionieren wobei ich noch unzufrieden bin, dass der User selbst das Ajenti Standard Passwort ändern muss.

_daniel4711 07/17/2016 09:02
Die aktuelle Installation hab ich noch nicht ausprobiert. Aber mal eine grundsätzliche Frage. Beim Aufruf der Domain werd ich immer wieder auf [Only registered and activated users can see links. Click Here To Register...] geleitet. [Only registered and activated users can see links. Click Here To Register...] funktioniert nicht. Was müsste ich an der conf ändern?

REtender 07/17/2016 13:11
Quote:
Originally Posted by _daniel4711 (Post 34845332)
Die aktuelle Installation hab ich noch nicht ausprobiert. Aber mal eine grundsätzliche Frage. Beim Aufruf der Domain werd ich immer wieder auf [Only registered and activated users can see links. Click Here To Register...] geleitet. [Only registered and activated users can see links. Click Here To Register...] funktioniert nicht. Was müsste ich an der conf ändern?
Schau mal in der Userconfig:
Quote:
# Enter your domain without a subdomain (www) unless you know what you are doing!
# --------------------------------
MYDOMAIN="yourdomain.tld"
Nachträglich kann man das nur über Nginx ändern -> Vhosts-Konfiguration (/etc/nginx/sites-available) denke ich mal :)
Wenn man "redirect www to https nginx" googled finden sich Beispiele von configs bzw. Ansätzen... ich bin gerade leider auf dem Sprung, vll hilft es ja dennoch.

bubliko 07/17/2016 14:24
kann jemand auch eine Version ohne Mailserver machen?

ich nutze immer die Mailserver von meinem Hoster, da es öffters mal sehr anstrengent ist mit eigenem Server. muss ja immer erreichbar sein.
oder kann Postfix & Co einfach ausschalten, ohne dass die Mails über "Kontaktformular" ankommen?

wie geht man da am besten vor?

TakeThisBitch 07/17/2016 14:44
Du kannst mailserver einfach deaktivieren. Dann musst du nur die config beim hoster so lassen wie es ist. Das sollte klappen :)

Gesendet von meinem C6903 mit Tapatalk

_daniel4711 07/17/2016 19:53
Quote:
Originally Posted by REtender (Post 34846151)
Schau mal in der Userconfig:


Nachträglich kann man das nur über Nginx ändern -> Vhosts-Konfiguration (/etc/nginx/sites-available) denke ich mal :)
Wenn man "redirect www to https nginx" googled finden sich Beispiele von configs bzw. Ansätzen... ich bin gerade leider auf dem Sprung, vll hilft es ja dennoch.
Google hat nur mäßigen Erfolg gehabt. Ich zieh das ganze nochmal neu auf.
Ein nettes zusätzliches Future wäre die Integration von Froxlor oder Ajenti V.

Ansonsten super Arbeit!!

Mit der aktuellen Installation klappt es leider nicht mehr. Ich bekomme einfach kein gültiges Zertifikat mehr erstellt.

Spoiler:
Dies ist keine sichere Verbindung

Unbefugte Dritte könnten versuchen, Ihre Informationen von [Only registered and activated users can see links. Click Here To Register...] zu stehlen, z. B. Passwörter, Nachrichten oder Kreditkartendaten. NET::ERR_CERT_AUTHORITY_INVALID

TakeThisBitch 07/20/2016 18:01
Wenn ich das mache:
Code:
cd ~/sources/letsencrypt
Code:
./letsencrypt-auto --agree-tos --renew-by-default --email [email][Only registered and activated users can see links. Click Here To Register...][/email] --rsa-key-size 4096 -d deinedomain.tld -d [url=http://www.deinedomain.tld]hattie[/url] -d mail.deinedomain.tld -d autodiscover.deinedomain.tld -d autoconfig.deinedomain.tld -d dav.deinedomain.tld certonly

Dann fragt er "How would you like to authenticate with the ACME CA?"

1 Place files in webroot directory (webroot)
2 Automatically use a temporary webserver (standalone)

Wäre es nicht der zweite Punkt?
Denn das Ergebnis von Punkt 2 ist
[IMG=expandable: 1]http://image.prntscr.com/image/24fc048c04124612992f19ce9970b4d6.png[/IMG]

Mag jetzt da auch nix falsch machen zwangsläufig.

Muss ich jetzt

1. den ersten Punkt nehmen oder
2. nginx vorher stoppen?

Axiades 07/23/2016 23:29
Moinsen,

ich habe leider derzeit ein Problem mit der Installation von Joomla 3.6 auf dem Nginx Webserver.

Wass muss ich ändern dass der Server ALLEs Erfolgreich abschließt

REtender 07/28/2016 03:26
Sooo, nach einer langen Nacht hat Ajenti nun auch ein automatisch generiertes sicheres Passwort :)

Die Vorbereitungen für eine Openvpn Installation laufen schon, aber ob ich das zeitnah schaffe :D

[Only registered and activated users can see links. Click Here To Register...]
Falls es wer testen mag

Axiades 08/03/2016 00:11
Quote:
Originally Posted by REtender (Post 34904218)
Sooo, nach einer langen Nacht hat Ajenti nun auch ein automatisch generiertes sicheres Passwort :)

Die Vorbereitungen für eine Openvpn Installation laufen schon, aber ob ich das zeitnah schaffe :D

[Only registered and activated users can see links. Click Here To Register...]
Falls es wer testen mag
Wie Lang dauert es noch ca. bis OpenVPN einsatzbereit währe ?! :D

REtender 08/03/2016 21:04
Quote:
Originally Posted by Axiades (Post 34941230)
Wie Lang dauert es noch ca. bis OpenVPN einsatzbereit währe ?! :D
Rechne nicht zeitnah damit :)
Aktuell bin ich im RL sehr beschäftigt und ich muss mich selbst genau mit einer sicheren Umsetzung auseinander setzen, damit da kein totaler Murks bei rumkommt :)

Entonsammler 08/04/2016 15:15
.

TakeThisBitch 08/04/2016 18:02
Wann hast du das gemacht? Das dauert bis zu 48 Stunden. Oder es kann bis zu 48 Stunden dauern.



Gesendet von meinem C6903 mit Tapatalk

Entonsammler 08/04/2016 18:46
Hat sich schon geklärt :D.
Ich hab ne Frage zu Roundcube, wo steht der Benutzer und Pw (Bin wieder mal zu Blind)

TakeThisBitch 08/04/2016 18:51
In der gleichen file wie alle anderen Passwörter im root Verzeichnis

Gesendet von meinem C6903 mit Tapatalk

Entonsammler 08/04/2016 19:06
da steht zwar was zur Database davon aber nicht dazu selbst wie bei mailcow,
habe mit Benutzernamen und Passwörtern schon rumprobiert

Axiades 08/04/2016 22:55
Quote:
Originally Posted by REtender (Post 34946291)
Rechne nicht zeitnah damit :)
Aktuell bin ich im RL sehr beschäftigt und ich muss mich selbst genau mit einer sicheren Umsetzung auseinander setzen, damit da kein totaler Murks bei rumkommt :)
Allaska ^^

Dann weiß ich schonmal Bescheid ^^

Gibt es den eine Möglichkeit OpenVPN sobald es im Script ist nachzukonfigurieren per Update Script?

Quote:
Originally Posted by Themanwhoisit (Post 34951756)
da steht zwar was zur Database davon aber nicht dazu selbst wie bei mailcow,
habe mit Benutzernamen und Passwörtern schon rumprobiert
Du musst im MailCow eine E-Mail Adresse anlegen um dich im Roundcube anzumelden..

TakeThisBitch 08/08/2016 08:57
Hat jemand ein kleines how to zum updaten von nginx in diesem System?

REtender 08/08/2016 22:08
Quote:
Originally Posted by TakeThisBitch (Post 34972190)
Hat jemand ein kleines how to zum updaten von nginx in diesem System?
Man könnte bestimmt den Update Script von mxiiii umschreiben
[Only registered and activated users can see links. Click Here To Register...]

Edit:

Ich habe die update_server.sh mal grob "entmüllt".
Es funktioniert so DEFINITIV NICHT! Es ist nur ein Ansatz falls wer basteln möchte.
Spoiler:
Code:
source ~/updateconfig.cfg

IPADR=$(ifconfig eth0 | awk -F ' *|:' '/inet /{print $4}')

# Some nice colors
red() { echo "$(tput setaf 1)$*$(tput setaf 9)"; }
green() { echo "$(tput setaf 2)$*$(tput setaf 9)"; }
yellow() { echo "$(tput setaf 3)$*$(tput setaf 9)"; }
magenta() { echo "$(tput setaf 5)$*$(tput setaf 9)"; }
cyan() { echo "$(tput setaf 6)$*$(tput setaf 9)"; }
textb() { echo $(tput bold)${1}$(tput sgr0); }
greenb() { echo $(tput bold)$(tput setaf 2)${1}$(tput sgr0); }
redb() { echo $(tput bold)$(tput setaf 1)${1}$(tput sgr0); }
yellowb() { echo $(tput bold)$(tput setaf 3)${1}$(tput sgr0); }
pinkb() { echo $(tput bold)$(tput setaf 5)${1}$(tput sgr0); }

# Some nice variables
info="$(textb [INFO] -)"
warn="$(yellowb [WARN] -)"
error="$(redb [ERROR] -)"
fyi="$(pinkb [INFO] -)"
ok="$(greenb [OKAY] -)"

echo
echo "$(yellowb +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+)"
echo " $(textb Perfect) $(textb Rootserver) $(textb Update) $(textb by)" "$(cyan MXIIII)"
echo "$(yellowb +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+)"
echo
if [ "$CONFIG_COMPLETED" != '1' ]; then
echo "${error} Please check the userconfig and set a valid value for the variable \"$(textb CONFIG_COMPLETED)\" to continue." | awk '{ print strftime("[%H:%M:%S] |"), $0 }'
exit 1
fi

echo "${info} Backup..."
rm /root/backup/ -r >/dev/null 2>&1
mkdir /root/backup/nginx >/dev/null 2>&1
cp -R /etc/nginx/* /root/backup/nginx

echo "${info} Install..."
echo
echo "$(yellowb +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+)"
echo " $(textb Perfect) $(textb Rootserver) $(textb Update) $(textb by)" "$(cyan MXIIII)"
echo "$(yellowb +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+)"
echo
echo "${info} Backup..."
echo "${info} Install..."
echo "${info} NGINX Update..."
echo "${warn} Some of the tasks could take a long time, please be patient!"
service nginx stop

cd ~/sources
echo "${info} Downloading Nginx..."
wget -nc http://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz >/dev/null 2>&1
tar -xzf nginx-${NGINX_VERSION}.tar.gz
cd nginx-${NGINX_VERSION}

./configure --prefix=/etc/nginx \
--sbin-path=/usr/sbin/nginx \
--conf-path=/etc/nginx/nginx.conf \
--error-log-path=/var/log/nginx/error.log \
--http-log-path=/var/log/nginx/access.log \
--pid-path=/var/run/nginx.pid \
--lock-path=/var/run/nginx.lock \
--http-client-body-temp-path=/var/lib/nginx/body \
--http-proxy-temp-path=/var/lib/nginx/proxy \
--http-fastcgi-temp-path=/var/lib/nginx/fastcgi \
--http-uwsgi-temp-path=/var/lib/nginx/uwsgi \
--http-scgi-temp-path=/var/lib/nginx/scgi \
--user=www-data \
--group=www-data \
--without-http_autoindex_module \
--without-http_browser_module \
--without-http_empty_gif_module \
--without-http_userid_module \
--without-http_split_clients_module \
--with-http_ssl_module \
--with-http_v2_module \
--with-http_realip_module \
--with-http_geoip_module \
--with-http_addition_module \
--with-http_sub_module \
--with-http_dav_module \
--with-http_flv_module \
--with-http_mp4_module \
--with-http_gunzip_module \
--with-http_gzip_static_module \
--with-http_random_index_module \
--with-http_secure_link_module \
--with-http_stub_status_module \
--with-http_auth_request_module \
--with-mail \
--with-mail_ssl_module \
--with-file-aio \
--with-ipv6 \
--with-debug \
--with-pcre \
--with-cc-opt='-O2 -g -pipe -Wall -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic' \
--with-openssl=$HOME/sources/openssl-${OPENSSL_VERSION} \
--add-module=$HOME/sources/ngx_pagespeed-release-${NPS_VERSION}-beta >/dev/null 2>&1

echo "${info} NGINX Install..."
make >/dev/null 2>&1

checkinstall --install=no -y >/dev/null 2>&1

dpkg -i nginx_${NGINX_VERSION}-1_amd64.deb >/dev/null 2>&1

mv nginx_${NGINX_VERSION}-1_amd64.deb ../
cp -R /root/backup/nginx/* /etc/nginx/

cat > /etc/nginx/sites-available/autodiscover.${MYDOMAIN}.conf <<END
 server {
                        listen 80;
                        server_name autodiscover.${MYDOMAIN} autoconfig.${MYDOMAIN};
                        return 301 https://autodiscover.${MYDOMAIN}\$request_uri;
 }
 
 server {
                        listen 443 ssl http2;
                        server_name autodiscover.${MYDOMAIN} autoconfig.${MYDOMAIN};
 
                        root /var/www/zpush;
                        index index.php;
                        charset utf-8;
 
                        error_page 404 /index.php;
 
                        ssl_certificate        ssl/${MYDOMAIN}.pem;
                        ssl_certificate_key ssl/${MYDOMAIN}.key;
                        #ssl_trusted_certificate ssl/${MYDOMAIN}.pem;
                        ssl_dhparam                    ssl/dh.pem;
                        #ssl_ecdh_curve                secp384r1;
                        ssl_session_cache  shared:SSL:10m;
                        ssl_session_timeout 10m;
                        ssl_session_tickets off;
                        ssl_protocols      TLSv1 TLSv1.1 TLSv1.2;
                        ssl_prefer_server_ciphers on;
                        ssl_buffer_size        1400;
 
                        #ssl_stapling                on;
                        #ssl_stapling_verify on;
                        #resolver                        8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s;
                        #resolver_timeout        2s;
 
                        ssl_ciphers                "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK";
 
                        #add_header                Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
                        #add_header                Public-Key-Pins 'pin-sha256="${HPKP1}"; pin-sha256="${HPKP2}"; max-age=5184000; includeSubDomains';
                        add_header                        Cache-Control "public";
                        add_header                        X-Frame-Options SAMEORIGIN;
                        add_header                        Alternate-Protocol  443:npn-http/2;
                        add_header                        X-Content-Type-Options nosniff;
                        add_header                        X-XSS-Protection "1; mode=block";
                        add_header                        X-Permitted-Cross-Domain-Policies "master-only";
                        add_header                        "X-UA-Compatible" "IE=Edge";
                        add_header                        "Access-Control-Allow-Origin" "*";
                        add_header                        Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval' *.youtube.com maps.gstatic.com *.googleapis.com *.google-analytics.com cdnjs.cloudflare.com assets.zendesk.com connect.facebook.net; frame-src 'self' *.youtube.com assets.zendesk.com *.facebook.com s-static.ak.facebook.com tautt.zendesk.com; object-src 'self'";
 
                        auth_basic_user_file htpasswd/.htpasswd;
 
                        location ~ ^(.+\.php)(.*)\$ {
                                fastcgi_split_path_info ^(.+\.php)(/.+)\$;
                                try_files \$fastcgi_script_name =404;
                                set \$path_info \$fastcgi_path_info;
                                fastcgi_param PATH_INFO \$path_info;
                                fastcgi_param APP_ENV production;
                                fastcgi_pass unix:/var/run/php5-fpm.sock;
                                fastcgi_index index.php;
                                include fastcgi.conf;
                                fastcgi_intercept_errors on;
                                fastcgi_ignore_client_abort off;
                                fastcgi_buffers 256 16k;
                                fastcgi_buffer_size 128k;
                                fastcgi_connect_timeout 3s;
                                fastcgi_send_timeout 120s;
                                fastcgi_read_timeout 120s;
                                fastcgi_busy_buffers_size 256k;
                                fastcgi_temp_file_write_size 256k;
                        }
 
                        rewrite (?i)^/autodiscover/autodiscover\.xml\$ /autodiscover/autodiscover.php;
 
                        location / {
                                try_files \$uri \$uri/ /index.php;
                        }
 
                        location /Microsoft-Server-ActiveSync {
                    rewrite ^(.*)\$  /index.php last;
                }
 
                        location ~ /(\.ht|Core|Specific) {
                deny all;
                return 404;
                }
 
                        location = /favicon.ico {
                                access_log off;
                                log_not_found off;
                        }
                               
                        location = /robots.txt {
                                allow all;
                                access_log off;
                                log_not_found off;
                        }
 
                        location ~* ^.+\.(css|js)\$ {
                                rewrite ^(.+)\.(\d+)\.(css|js)\$ \$1.\$3 last;
                                expires 30d;
                                access_log off;
                                log_not_found off;
                                add_header Pragma public;
                                add_header Cache-Control "max-age=2592000, public";
                        }
 
                        location ~* \.(asf|asx|wax|wmv|wmx|avi|bmp|class|divx|doc|docx|eot|exe|gif|gz|gzip|ico|jpg|jpeg|jpe|mdb|mid|midi|mov|qt|mp3|m4a|mp4|m4v|mpeg|mpg|mpe|mpp|odb|odc|odf|odg|odp|ods|odt|ogg|ogv|otf|pdf|png|pot|pps|ppt|pptx|ra|ram|svg|svgz|swf|tar|t?gz|tif|tiff|ttf|wav|webm|wma|woff|wri|xla|xls|xlsx|xlt|xlw|zip)\$ {
                                expires 30d;
                                access_log off;
                                log_not_found off;
                                add_header Pragma public;
                                add_header Cache-Control "max-age=2592000, public";
                        }
 
                        if (\$http_user_agent ~* "FeedDemon|JikeSpider|Indy Library|Alexa Toolbar|AskTbFXTV|AhrefsBot|CrawlDaddy|CoolpadWebkit|Java|Feedly|UniversalFeedParser|ApacheBench|Microsoft URL Control|Swiftbot|ZmEu|oBot|jaunty|Python-urllib|lightDeckReports Bot|YYSpider|DigExt|YisouSpider|HttpClient|MJ12bot|heritrix|EasouSpider|Ezooms|Scrapy") {
                    return 403;
            }
 
 }
END

cat > /etc/nginx/sites-available/dav.${MYDOMAIN}.conf <<END
 server {
                        listen 80;
                        server_name dav.${MYDOMAIN};
                        return 301 https://dav.${MYDOMAIN}\$request_uri;
 }
 
 server {
                        listen 443 ssl http2;
                        server_name dav.${MYDOMAIN};
 
                        root /var/www/dav;
                        index server.php;
                        charset utf-8;
 
                        error_page 404 /index.php;
 
                        ssl_certificate        ssl/${MYDOMAIN}.pem;
                        ssl_certificate_key ssl/${MYDOMAIN}.key;
                        #ssl_trusted_certificate ssl/${MYDOMAIN}.pem;
                        ssl_dhparam                    ssl/dh.pem;
                        #ssl_ecdh_curve                secp384r1;
                        ssl_session_cache  shared:SSL:10m;
                        ssl_session_timeout 10m;
                        ssl_session_tickets off;
                        ssl_protocols      TLSv1 TLSv1.1 TLSv1.2;
                        ssl_prefer_server_ciphers on;
                        ssl_buffer_size        1400;
 
                        #ssl_stapling                on;
                        #ssl_stapling_verify on;
                        #resolver                        8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s;
                        #resolver_timeout        2s;
 
                        ssl_ciphers                "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK";
 
                        #add_header                Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
                        #add_header                Public-Key-Pins 'pin-sha256="${HPKP1}"; pin-sha256="${HPKP2}"; max-age=5184000; includeSubDomains';
                        add_header                        Cache-Control "public";
                        add_header                        X-Frame-Options SAMEORIGIN;
                        add_header                        Alternate-Protocol  443:npn-http/2;
                        add_header                        X-Content-Type-Options nosniff;
                        add_header                        X-XSS-Protection "1; mode=block";
                        add_header                        X-Permitted-Cross-Domain-Policies "master-only";
                        add_header                        "X-UA-Compatible" "IE=Edge";
                        add_header                        "Access-Control-Allow-Origin" "*";
                        add_header                        Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval' *.youtube.com maps.gstatic.com *.googleapis.com *.google-analytics.com cdnjs.cloudflare.com assets.zendesk.com connect.facebook.net; frame-src 'self' *.youtube.com assets.zendesk.com *.facebook.com s-static.ak.facebook.com tautt.zendesk.com; object-src 'self'";
                       
                        auth_basic_user_file htpasswd/.htpasswd;
 
                        location ~ ^(.+\.php)(.*)\$ {
                                fastcgi_split_path_info ^(.+\.php)(/.+)\$;
                                try_files \$fastcgi_script_name =404;
                                set \$path_info \$fastcgi_path_info;
                                fastcgi_param PATH_INFO \$path_info;
                                fastcgi_param APP_ENV production;
                                fastcgi_pass unix:/var/run/php5-fpm.sock;
                                fastcgi_index index.php;
                                include fastcgi.conf;
                                fastcgi_intercept_errors on;
                                fastcgi_ignore_client_abort off;
                                fastcgi_buffers 256 16k;
                                fastcgi_buffer_size 128k;
                                fastcgi_connect_timeout 3s;
                                fastcgi_send_timeout 120s;
                                fastcgi_read_timeout 120s;
                                fastcgi_busy_buffers_size 256k;
                                fastcgi_temp_file_write_size 256k;
                        }
 
                        rewrite ^/.well-known/caldav /server.php redirect;
                        rewrite ^/.well-known/carddav /server.php redirect;
 
                        location / {
                                try_files \$uri \$uri/ /server.php?\$args;
                        }
 
                        location ~ /(\.ht|Core|Specific) {
                deny all;
                return 404;
                }
 
                        location = /favicon.ico {
                                access_log off;
                                log_not_found off;
                        }
                               
                        location = /robots.txt {
                                allow all;
                                access_log off;
                                log_not_found off;
                        }
 
                        location ~* ^.+\.(css|js)\$ {
                                rewrite ^(.+)\.(\d+)\.(css|js)\$ \$1.\$3 last;
                                expires 30d;
                                access_log off;
                                log_not_found off;
                                add_header Pragma public;
                                add_header Cache-Control "max-age=2592000, public";
                        }
 
                        location ~* \.(asf|asx|wax|wmv|wmx|avi|bmp|class|divx|doc|docx|eot|exe|gif|gz|gzip|ico|jpg|jpeg|jpe|mdb|mid|midi|mov|qt|mp3|m4a|mp4|m4v|mpeg|mpg|mpe|mpp|odb|odc|odf|odg|odp|ods|odt|ogg|ogv|otf|pdf|png|pot|pps|ppt|pptx|ra|ram|svg|svgz|swf|tar|t?gz|tif|tiff|ttf|wav|webm|wma|woff|wri|xla|xls|xlsx|xlt|xlw|zip)\$ {
                                expires 30d;
                                access_log off;
                                log_not_found off;
                                add_header Pragma public;
                                add_header Cache-Control "max-age=2592000, public";
                        }
 
                        if (\$http_user_agent ~* "FeedDemon|JikeSpider|Indy Library|Alexa Toolbar|AskTbFXTV|AhrefsBot|CrawlDaddy|CoolpadWebkit|Java|Feedly|UniversalFeedParser|ApacheBench|Microsoft URL Control|Swiftbot|ZmEu|oBot|jaunty|Python-urllib|lightDeckReports Bot|YYSpider|DigExt|YisouSpider|HttpClient|MJ12bot|heritrix|EasouSpider|Ezooms|Scrapy") {
                    return 403;
            }
 }
END

cat > /etc/nginx/sites-available/${MYDOMAIN}.conf <<END
 server {
                        listen                                80 default_server;
                        server_name                ${IPADR} ${MYDOMAIN};
                        return 301                        https://${MYDOMAIN}\$request_uri;
 }
 
 server {
                        listen                                443;
                        server_name                ${IPADR} www.${MYDOMAIN} mail.${MYDOMAIN};
                        return 301                        https://${MYDOMAIN}\$request_uri;
 }
 
 server {
                        listen                                443 ssl http2 default deferred;
                        server_name                ${MYDOMAIN};
 
                        root                                /etc/nginx/html;
                        index                                index.php index.html index.htm;
 
                        charset                        utf-8;
 
                        error_page 404                /index.php;
 
                        ssl_certificate        ssl/${MYDOMAIN}.pem;
                        ssl_certificate_key ssl/${MYDOMAIN}.key;
                        #ssl_trusted_certificate ssl/${MYDOMAIN}.pem;
                        ssl_dhparam                    ssl/dh.pem;
                        #ssl_ecdh_curve                secp384r1;
                        ssl_session_cache  shared:SSL:10m;
                        ssl_session_timeout 10m;
                        ssl_session_tickets off;
                        ssl_protocols      TLSv1 TLSv1.1 TLSv1.2;
                        ssl_prefer_server_ciphers on;
                        ssl_buffer_size        1400;
 
                        #ssl_stapling                on;
                        #ssl_stapling_verify on;
                        #resolver                        8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s;
                        #resolver_timeout        2s;
 
                        ssl_ciphers                "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK";
 
                        #add_header                Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
                        #add_header                Public-Key-Pins 'pin-sha256="${HPKP1}"; pin-sha256="${HPKP2}"; max-age=5184000; includeSubDomains';
                        add_header                        Cache-Control "public";
                        add_header                        X-Frame-Options SAMEORIGIN;
                        add_header                        Alternate-Protocol  443:npn-http/2;
                        add_header                        X-Content-Type-Options nosniff;
                        add_header                        X-XSS-Protection "1; mode=block";
                        add_header                        X-Permitted-Cross-Domain-Policies "master-only";
                        add_header                        "X-UA-Compatible" "IE=Edge";
                        add_header                        "Access-Control-Allow-Origin" "*";
                        add_header                        Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval' *.youtube.com maps.gstatic.com *.googleapis.com *.google-analytics.com cdnjs.cloudflare.com assets.zendesk.com connect.facebook.net; frame-src 'self' *.youtube.com assets.zendesk.com *.facebook.com s-static.ak.facebook.com tautt.zendesk.com; object-src 'self'";
 
                        pagespeed                        on;
                        pagespeed                        EnableFilters collapse_whitespace;
                        pagespeed                        EnableFilters canonicalize_javascript_libraries;
                        pagespeed                        EnableFilters combine_css;
                        pagespeed                        EnableFilters combine_javascript;
                        pagespeed                        EnableFilters elide_attributes;
                        pagespeed                        EnableFilters extend_cache;
                        pagespeed                        EnableFilters flatten_css_imports;
                        pagespeed                        EnableFilters lazyload_images;
                        pagespeed                        EnableFilters rewrite_javascript;
                        pagespeed                        EnableFilters rewrite_images;
                        pagespeed                        EnableFilters insert_dns_prefetch;
                        pagespeed                        EnableFilters prioritize_critical_css;
 
                        pagespeed                        FetchHttps enable,allow_self_signed;
                        pagespeed                        FileCachePath /var/lib/nginx/nps_cache;
                        pagespeed                        RewriteLevel CoreFilters;
                        pagespeed                        CssFlattenMaxBytes 5120;
                        pagespeed                        LogDir /var/log/pagespeed;
                        pagespeed                        EnableCachePurge on;
                        pagespeed                        PurgeMethod PURGE;
                        pagespeed                        DownstreamCachePurgeMethod PURGE;
                        pagespeed                        DownstreamCachePurgeLocationPrefix http://127.0.0.1:80/;
                        pagespeed                        DownstreamCacheRewrittenPercentageThreshold 95;
                        pagespeed                        LazyloadImagesAfterOnload on;
                        pagespeed                        LazyloadImagesBlankUrl "data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7";
 
                        pagespeed                        MemcachedThreads 1;
                        pagespeed                        MemcachedServers "localhost:11211";
                        pagespeed                        MemcachedTimeoutUs 100000;
                        pagespeed                        RespectVary on;
 
                        pagespeed                        Disallow "*/pma/*";
 
                        # This will correctly rewrite your subresources with https:// URLs and thus avoid mixed content warnings.
                        # Note, that you should only enable this option if you are behind a load-balancer that will set this header,
                        # otherwise your users will be able to set the protocol PageSpeed uses to interpret the request.
                        #
                        #pagespeed                        RespectXForwardedProto on;
 
                        auth_basic_user_file htpasswd/.htpasswd;
 
                        location ~ \.php\$ {
                                fastcgi_split_path_info ^(.+\.php)(/.+)\$;
                                try_files \$fastcgi_script_name =404;
                                fastcgi_param PATH_INFO \$fastcgi_path_info;
                                fastcgi_param PATH_TRANSLATED \$document_root\$fastcgi_path_info;
                                fastcgi_param APP_ENV production;
                                fastcgi_pass unix:/var/run/php5-fpm.sock;
                                fastcgi_index index.php;
                                include fastcgi.conf;
                                fastcgi_intercept_errors off;
                                fastcgi_ignore_client_abort off;
                                fastcgi_buffers 256 16k;
                                fastcgi_buffer_size 128k;
                                fastcgi_connect_timeout 3s;
                                fastcgi_send_timeout 120s;
                                fastcgi_read_timeout 120s;
                                fastcgi_busy_buffers_size 256k;
                                fastcgi_temp_file_write_size 256k;
                        }
 
                        include /etc/nginx/sites-custom/*.conf;
 
                        location / {
                                    include /etc/nginx/naxsi.rules;
 
                                    # Uncomment, if you need to remove index.php from the
                                # URL. Usefull if you use Codeigniter, Zendframework, etc.
                                # or just need to remove the index.php
                                #
                                    #try_files \$uri \$uri/ /index.php?\$args;
                        }
 
                        location ~* /\.(?!well-known\/) {
                            deny all;
                            access_log off;
                                log_not_found off;
                        }
 
                        location ~* (?:\.(?:bak|conf|dist|fla|in[ci]|log|psd|sh|sql|sw[op])|~)$ {
                            deny all;
                            access_log off;
                                log_not_found off;
                        }
 
                        location = /favicon.ico {
                                access_log off;
                                log_not_found off;
                        }
                               
                        location = /robots.txt {
                                allow all;
                                access_log off;
                                log_not_found off;
                        }
 
                        location ~* ^.+\.(css|js)\$ {
                                rewrite ^(.+)\.(\d+)\.(css|js)\$ \$1.\$3 last;
                                expires 30d;
                                access_log off;
                                log_not_found off;
                                add_header Pragma public;
                                add_header Cache-Control "max-age=2592000, public";
                        }
 
                        location ~* \.(asf|asx|wax|wmv|wmx|avi|bmp|class|divx|doc|docx|eot|exe|gif|gz|gzip|ico|jpg|jpeg|jpe|mdb|mid|midi|mov|qt|mp3|m4a|mp4|m4v|mpeg|mpg|mpe|mpp|odb|odc|odf|odg|odp|ods|odt|ogg|ogv|otf|pdf|png|pot|pps|ppt|pptx|ra|ram|svg|svgz|swf|tar|t?gz|tif|tiff|ttf|wav|webm|wma|woff|wri|xla|xls|xlsx|xlt|xlw|zip)\$ {
                                expires 30d;
                                access_log off;
                                log_not_found off;
                                add_header Pragma public;
                                add_header Cache-Control "max-age=2592000, public";
                        }
 
                        if (\$http_user_agent ~* "FeedDemon|JikeSpider|Indy Library|Alexa Toolbar|AskTbFXTV|AhrefsBot|CrawlDaddy|CoolpadWebkit|Java|Feedly|UniversalFeedParser|ApacheBench|Microsoft URL Control|Swiftbot|ZmEu|oBot|jaunty|Python-urllib|lightDeckReports Bot|YYSpider|DigExt|YisouSpider|HttpClient|MJ12bot|heritrix|EasouSpider|Ezooms|Scrapy") {
                    return 403;
            }
 }
END
service nginx start

TiggaStyle 08/11/2016 07:32
Moinsen,

sag mal waren hier nicht welche bei netcup?

Ich hab da mal nen Server bestellt, allerdings braucht die arno-firewall mit einlesen der 38k IPs aus dem Blocked Hosts ewig um zu starten, 8 Minuten oder so? Ohne die blocked-hosts geht normal schnell.
Ist das bei netcup so?

Gruß

Axiades 08/12/2016 15:21
Moinsen,

Hab da mal ne frage.. Kann ich dieses Script auch so nutzen dass er mir den Webserver & den MailServer nicht mit installiert.. ??

wenn ja. Wie?

Freue mich auf Antworten.

REtender 08/13/2016 00:18
Quote:
Originally Posted by Axiades (Post 34998078)
Moinsen,

Hab da mal ne frage.. Kann ich dieses Script auch so nutzen dass er mir den Webserver & den MailServer nicht mit installiert.. ??

wenn ja. Wie?

Freue mich auf Antworten.
In der Userconfig USE_MAILSERVER="1" auf 0 stellen?
Das Script kann man allerdings nicht ohne weiteres ohne Webserver installieren.

[Only registered and activated users can see links. Click Here To Register...]
hat noch wer die neuen Versionen von Nginx und co getestet?
Bei mir ging es ohne Probleme...

TakeThisBitch 08/13/2016 00:38
Hab nach wie vor kein nginx update gemacht :o
Trau mich da nicht ran. Muss ich vorher nen image erstellen
@[Only registered and activated users can see links. Click Here To Register...] ich habe das noch nicht gemacht. Könntest du kurz erklären wie du das machst? Dann kann ich es mal testen.

Klingt auch interessant

Gesendet von meinem C6903 mit Tapatalk

Wäre wirkoch nett, wenn mir jemand helfen könnte nginx zu updaten.

Habe einige Tutorials ausprobiert, aber ohne Erfolg.
[Only registered and activated users can see links. Click Here To Register...]
[Only registered and activated users can see links. Click Here To Register...]
[Only registered and activated users can see links. Click Here To Register...]
[Only registered and activated users can see links. Click Here To Register...]

und einfach neu installieren geht auch nicht:
Code:
root@mail:~# apt-get install nginx
Reading package lists... Done
Building dependency tree
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 nginx : Depends: nginx-full (>= 1.10.1-1) but 1.6.2-5+deb8u2+b1 is to be instal                                  led or
                  nginx-light (>= 1.10.1-1) but it is not going to be installed                                  or
                  nginx-extras (>= 1.10.1-1) but it is not going to be installed
E: Unable to correct problems, you have held broken packages.
root@mail:~#
nginx upgrade geht auch nicht:
Code:
root@mail:~# nginx -v
nginx version: nginx/1.10.0
root@mail:~# apt-get upgrade nginx
Reading package lists... Done
Building dependency tree
Reading state information... Done
Calculating upgrade... Some packages could not be installed. This may mean that                                                              you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 nginx : Depends: nginx-full (>= 1.10.1-1) but it is not going to be installed o                                                            r
                  nginx-light (>= 1.10.1-1) but it is not going to be installed                                                              or
                  nginx-extras (>= 1.10.1-1) but it is not going to be installed
        Depends: nginx-full (< 1.10.1-1.1~) but it is not going to be installed                                                              or
                  nginx-light (< 1.10.1-1.1~) but it is not going to be installe                                                            d or
                  nginx-extras (< 1.10.1-1.1~) but it is not going to be install                                                            ed
E: Broken packages

Delinquenz 08/13/2016 10:00
Quote:
Originally Posted by TakeThisBitch (Post 35001356)
nginx upgrade geht auch nicht:
Du musst wenn schon alle Abhängigkeiten von nginx upgraden, am besten upgradest du einfach gleich alle Packages.


All times are GMT +2. The time now is 20:49.
Page 8 of 12 « First 67 8 910 Last »
Show 40 post(s) from this thread on one page

Powered by vBulletin®
Copyright ©2000 - 2026, Jelsoft Enterprises Ltd.
SEO by vBSEO ©2011, Crawlability, Inc.