ssh root@93.115.96.97 Màj  

apt update && apt upgrade

hostnamectl set-hostname --static vps26381

127.0.0.1       localhost
93.115.96.97    xoyize.xyz vps26381


# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

hostname
	vps26381
hostname --fqdn
	xoyize.xyz

apt install rsync curl tmux jq figlet git mailutils dnsutils -y

dpkg-reconfigure locales

Generating locales (this might take a while)...
  fr_FR.UTF-8... done
  en_US.UTF-8... done
Generation complete.

dpkg-reconfigure tzdata

Current default time zone: 'Europe/Paris'
Local time is now:      Sat Mar 17 14:12:05 CET 2018.
Universal Time is now:  Sat Mar 17 13:12:05 UTC 2018.

passwd root

useradd -m -d /home/xoyan/ -s /bin/bash xoyan

passwd xoyan

apt install sudo -y #installé par défaut sur certaines distributions
echo "xoyan     ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers

ssh xoyan@93.115.96.97

$TTL 3600
@	IN SOA dns106.ovh.net. tech.ovh.net. (2018021102 86400 3600 3600000 300)
         IN NS     ns106.ovh.net.
         IN NS     dns106.ovh.net.
         IN MX 10  cinay.pw.
         IN A      93.115.96.97
         IN AAAA   2a03:75c0:35:670d::1
*        IN CNAME  xoyize.xyz.

dig +short MX xoyize.xyz
	10 cinay.pw.

ssh-keygen -t ed25519 -o -a 100 -f ~/.ssh/kvm-vps-26381

scp ~/.ssh/kvm-vps-26381.pub xoyan@93.115.96.97:/home/xoyan/

ssh xoyan@93.115.96.97

$ cd ~

pwd  #pour vérifier que l'on est sous /home/$USER
mkdir .ssh
cat /home/$USER/kvm-vps-26381.pub >> /home/$USER/.ssh/authorized_keys

chmod 600 /home/$USER/.ssh/authorized_keys

rm /home/$USER/kvm-vps-26381.pub

sudo nano /etc/ssh/sshd_config

Port = 55026
PermitRootLogin no
PasswordAuthentication no

sudo apt install libpam-systemd -y               #Installer par défaut sur debian 9

sudo systemctl restart sshd

ssh -p 55026 -i ~/.ssh/kvm-vps-26381 xoyan@93.115.96.97

nano ~/.ssh/rc

#!/bin/bash

#clear
PROCCOUNT=`ps -Afl | wc -l`  		# nombre de lignes
PROCCOUNT=`expr $PROCCOUNT - 5`		# on ote les non concernées
GROUPZ=`users`
ipinfo=$(curl -s ipinfo.io) 		# info localisation format json
publicip=$(echo $ipinfo | jq -r '.ip')  # extraction des données , installer préalablement "jq"
ville=$(echo $ipinfo | jq -r '.city')
pays=$(echo $ipinfo | jq -r '.country')
cpuname=`cat /proc/cpuinfo |grep 'model name' | cut -d: -f2 | sed -n 1p`

echo "\033[0m\033[1;31m"  
figlet "xoyize.xyz"
echo "\033[0m"
echo "\033[1;35m  \033[1;37mHostname \033[1;35m= \033[1;32m`hostname`
\033[1;35m  \033[1;37mWired Ip \033[1;35m= \033[1;32m`ip addr show eth0 | grep 'inet\b' | awk '{print $2}' | cut -d/ -f1`
\033[1;35m    \033[1;37mKernel \033[1;35m= \033[1;32m`uname -r`
\033[1;35m    \033[1;37mDebian \033[1;35m= \033[1;32m`cat /etc/debian_version`
\033[1;35m    \033[1;37mUptime \033[1;35m= \033[1;32m`uptime | sed 's/.*up ([^,]*), .*/1/' | sed -e 's/^[ \t]*//'`
\033[1;35m       \033[1;37mCPU \033[1;35m= \033[1;32m`echo $cpuname`
\033[1;35m\033[1;37mMemory Use \033[1;35m= \033[1;32m`free -m | awk 'NR==2{printf "%s/%sMB (%.2f%%)\n", $3,$2,$3*100/$2 }'`
\033[1;35m  \033[1;37mUsername \033[1;35m= \033[1;32m`whoami`
\033[1;35m  \033[1;37mSessions \033[1;35m= \033[1;32m`who | grep $USER | wc -l`
\033[1;35m\033[1;37mPublic Ip  \033[1;35m= \033[1;32m`echo $publicip $pays`
\033[0m"
#curl fr.wttr.in/Paris?0

sudo rm /etc/motd

sudo -s # ou su

apt remove --purge bind* -y
rm -r /var/cache/bind/

apt install dnsutils unbound -y

cd /var/lib/unbound/ && wget ftp://ftp.internic.net/domain/named.cache

mv named.cache root.hints && chown unbound:unbound root.hints

server:
    # The following line will configure unbound to perform cryptographic
    # DNSSEC validation using the root trust anchor.
    auto-trust-anchor-file: "/var/lib/unbound/root.key"

server:
    # Send minimum amount of information to upstream servers to enhance
    # privacy. Only sends minimum required labels of the QNAME and sets
    # QTYPE to NS when possible.

    # See RFC 7816 "DNS Query Name Minimisation to Improve Privacy" for
    # details.

    qname-minimisation: yes

nano /etc/unbound/unbound.conf.d/dns-yan.conf

server:
 interface: 0.0.0.0
 interface: ::0
 access-control: 0.0.0.0/0 allow
 access-control: ::/0 allow
 root-hints: "/var/lib/unbound/root.hints"
 verbosity: 0
 #qname-minimisation: yes

 num-threads: 2
 msg-cache-slabs: 4
 rrset-cache-slabs: 4
 infra-cache-slabs: 4
 key-cache-slabs: 4
 rrset-cache-size: 100m
 msg-cache-size: 50m
 outgoing-range: 465
 so-rcvbuf: 4m
 so-sndbuf: 4m
 port: 53
 do-ip4: yes
 do-ip6: yes
 do-udp: yes
 do-tcp: yes
 do-daemonize: yes
 hide-identity: yes
 hide-version: yes
 harden-glue: yes
 harden-dnssec-stripped: yes
 harden-referral-path: yes
 use-caps-for-id: yes
 prefetch: yes

systemctl restart unbound

dig @127.0.0.1 afnic.fr +short +dnssec

192.134.5.25
A 8 2 600 20180406223409 20180307194345 64860 afnic.fr. lhw7AmNSkeZOtNN/9rJuGYxTdUcXSR3xlbsKz2xjNbFxQT5FwKILTW+E WWawrrbjo79uaG7kAvfMWrah4ijWtz9qGyd76qTr3XVdXB3+pbIsRr6X /I/ryQAy9w8tP3FvXHHU7IxihP+Ei2M5licCYitt1YZUyXuNFdNpdhq7 FRT+tq78yn1PEm121f32IRQ2Fjy9qZz9O0LU7roYZ6XFoPU9x3PU590J mpkywT9t6LpyeW5GK5zSL+Zb5eiFhfp33abkMf7b6Pc7xixcGN8h8SDQ Ry98Ne0EIqHKnyh/zzRszc1kBfP5kJXmcY/X3+4xLvKmvKNnBLT0dsn1 q1Hl1A==

apt install resolvconf -y
echo "nameserver 127.0.0.1" >> /etc/resolvconf/resolv.conf.d/head

nslookup afnic.fr | grep Server

Server:     127.0.0.1

dig @127.0.0.1 afnic.fr

; <<>> DiG 9.10.3-P4-Debian <<>> @127.0.0.1 afnic.fr
; (1 server found)
...
;; SERVER: 127.0.0.1#53(127.0.0.1)
...

dig sigok.verteiltesysteme.net

dig sigfail.verteiltesysteme.net

nano /etc/unbound/dnsunbound-update-root-dns.sh

chmod +x /etc/unbound/dnsunbound-update-root-dns.sh

crontab -e

# Mise à jour automatique des serveurs DNS de la racine
50 02 * * * /etc/unbound/dnsunbound-update-root-dns.sh

sudo mkdir -p /etc/nginx/conf.d/xoyize.xyz.d

sudo mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/xoyize.xyz.conf

sudo nano /etc/nginx/conf.d/xoyize.xyz.conf

server {
    listen 80;
    listen [::]:80;
    root /var/www/ ;
        location ~ \.php$ {
           fastcgi_split_path_info ^(.+\.php)(/.+)$;
           fastcgi_pass unix:/run/php/php7.0-fpm.sock;    # PHP7.0
           fastcgi_index index.php;
           include fastcgi_params;
           fastcgi_param SCRIPT_FILENAME $request_filename;
        }

    include conf.d/xoyize.xyz.d/*.conf;

    access_log /var/log/nginx/xoyize.xyz.log;
    error_log /var/log/nginx/xoyize.xyz.log;
}

sudo systemctl reload nginx

sudo systemctl enable nginx

/root/.acme.sh/acme.sh --dns dns_ovh --issue --keylength 4096 -d xoyize.xyz -d smtp.xoyize.xyz -d imap.xoyize.xyz -d webmail.xoyize.xyz -d mail.xoyize.xyz -d nc.xoyize.xyz

[mercredi 14 février 2018, 08:03:43 (UTC+0100)] Your cert is in  /root/.acme.sh/xoyize.xyz/xoyize.xyz.cer
[mercredi 14 février 2018, 08:03:43 (UTC+0100)] Your cert key is in  /root/.acme.sh/xoyize.xyz/xoyize.xyz.key
[mercredi 14 février 2018, 08:03:43 (UTC+0100)] The intermediate CA cert is in  /root/.acme.sh/xoyize.xyz/ca.cer
[mercredi 14 février 2018, 08:03:43 (UTC+0100)] And the full chain certs is there:  /root/.acme.sh/xoyize.xyz/fullchain.cer

ln -s /root/.acme.sh/xoyize.xyz/fullchain.cer /etc/ssl/private/xoyize.xyz-fullchain.pem
ln -s /root/.acme.sh/xoyize.xyz/xoyize.xyz.key /etc/ssl/private/xoyize.xyz-key.pem
ln -s /root/.acme.sh/xoyize.xyz/xoyize.xyz.cer /etc/ssl/private/xoyize.xyz-chain.pem
ln -s /root/.acme.sh/xoyize.xyz/ca.cer /etc/ssl/private/xoyize.xyz-ca.pem

crontab -e

	11 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null

sudo nano /etc/nginx/ssl_params

    ssl_certificate /etc/ssl/private/xoyize.xyz-fullchain.pem;
    ssl_certificate_key /etc/ssl/private/xoyize.xyz-key.pem;
    ssl_session_timeout 5m;
    ssl_session_cache shared:SSL:50m;
    ssl_prefer_server_ciphers on;

    # Ciphers with intermediate compatibility
    # https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=nginx-1.6.2&openssl=1.0.1t&hsts=yes&profile=intermediate
    # ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    # ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';

    # Ciphers with modern compatibility
    # https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=nginx-1.6.2&openssl=1.0.1t&hsts=yes&profile=modern
    # Uncomment the following to use modern ciphers, but remove compatibility with some old clients (android before 5.0, Internet Explorer before 10, ...)
    ssl_protocols TLSv1.2;
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';

sudo nano /etc/nginx/header_params

    # Quelques explications https://www.alsacreations.com/article/lire/1723-tour-horizon-https-et-en-tetes-de-securite.html
    #HSTS est un dispositif de sécurité par lequel un site web peut déclarer aux navigateurs qu’ils doivent communiquer avec lui en utilisant exclusivement le protocole HTTPS, au lieu du HTTP
    add_header Strict-Transport-Security "max-age=31536000;";
    # Seul le site utilise peut utiliser iFrame
    add_header Content-Security-Policy "frame-ancestors 'self'";
    #se protéger contre le détournement de clic (clickjacking)
    add_header X-Frame-Options "SAMEORIGIN";
    # Empêche les navigateurs de détecter incorrectement les scripts qui ne sont pas des scripts
    add_header X-Content-Type-Options "nosniff";
    # Bloquer les pages à charger lorsqu'elles détectent des attaques XSS
    add_header X-XSS-Protection "1; mode=block";

    #Supprimer les ## des lignes  pour activer la fonction correspondante

    #CSP permet d’autoriser seulement les domaines déclarés à exécuter du script JavaScript, une feuille de style css, etc.
    # Content-Security-Policy : https://openweb.eu.org/articles/content-security-policy
    ## add_header Content-Security-Policy "default-src 'self'";

    # Désactiver les références pour les navigateurs qui ne prennent pas en charge strict-origin-when-cross-origin
    # Referrer-Policy : https://scotthelme.co.uk/a-new-security-header-referrer-policy/
    # Utilise strict-origin-when-cross-origin pour les navigateurs qui le font
    ## add_header Referrer-Policy "no-referrer, strict-origin-when-cross-origin";

openssl dhparam -out /etc/ssl/private/dh4096.pem -outform PEM -2 4096

sudo mv dh4096.pem /etc/ssl/private/

sudo chmod 600 /etc/ssl/private/dh4096.pem

sudo nano /etc/nginx/dh_param

    # Uncomment the following directive after DH generation
    # > openssl dhparam -out /etc/ssl/private/dh4096.pem -outform PEM -2 4096
    ssl_dhparam /etc/ssl/private/dh4096.pem;

sudo nano /etc/nginx/conf.d/xoyize.xyz.conf

server {
    listen 80;
    listen [::]:80;

    ## redirect http to https ##
    return  301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name xoyize.xyz;

    ####    Locations
    # On cache les fichiers statiques
    location ~* \.(html|css|js|png|jpg|jpeg|gif|ico|svg|eot|woff|ttf)$ { expires max; }
    # On interdit les dotfiles
    location ~ /\. { deny all; }

    include ssl_params;
    include header_params;
    include dh_param;

    root /var/www/ ;
    index index.php index.html index.htm;
        location ~ \.php$ {
           fastcgi_split_path_info ^(.+\.php)(/.+)$;
           fastcgi_pass unix:/run/php/php7.0-fpm.sock;    # PHP7.0
           fastcgi_index index.php;
           include fastcgi_params;
	   fastcgi_param SCRIPT_FILENAME $request_filename;
        }

    include conf.d/xoyize.xyz.d/*.conf;

    access_log /var/log/nginx/xoyize.xyz-access.log;
    error_log /var/log/nginx/xoyize.xyz-error.log;
}

sudo nginx -t

sudo systemctl restart nginx

curl -I xoyize.xyz

HTTP/1.1 301 Moved Permanently
Server: nginx/1.13.8
Date: Sun, 11 Feb 2018 12:37:36 GMT
Content-Type: text/html
Content-Length: 185
Connection: keep-alive
Location: https:///

cd ~
sudo nano parefeu

#!/bin/sh

# Efface toutes les règles en cours. -F toutes. -X utilisateurs
iptables -t filter -F
iptables -t filter -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
#
ip6tables -t filter -F
ip6tables -t filter -X

ip6tables -t mangle -F
ip6tables -t mangle -X

# stratégie (-P) par défaut : bloc tout l'entrant le forward et autorise le sortant
iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT ACCEPT
#
ip6tables -t filter -P INPUT DROP
ip6tables -t filter -P FORWARD DROP
ip6tables -t filter -P OUTPUT ACCEPT

# Ne pas casser les connexions etablies
iptables -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#
ip6tables -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Autoriser Loopback
iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A OUTPUT -o lo -j ACCEPT
#
ip6tables -t filter -A INPUT -i lo -j ACCEPT
ip6tables -t filter -A OUTPUT -o lo -j ACCEPT

# Autoriser icmp
iptables -t filter -A INPUT -p icmp -j ACCEPT
ip6tables -t filter -A INPUT -p icmp -j ACCEPT

# SSH
iptables -t filter -A INPUT -p tcp --dport 55026 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 55026 -j ACCEPT
#
ip6tables -t filter -A INPUT -p tcp --dport 55026 -j ACCEPT
ip6tables -t filter -A OUTPUT -p tcp --dport 55026 -j ACCEPT

# DNS in/out
# /!\ Il faut autoriser le DNS AVANT de déclarer des hosts sinon pas de résolution de nom possible
iptables -t filter -A OUTPUT -p tcp --dport 53 -j ACCEPT
iptables -t filter -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -t filter -A INPUT -p udp --dport 53 -j ACCEPT
#
ip6tables -t filter -A OUTPUT -p tcp --dport 53 -j ACCEPT
ip6tables -t filter -A OUTPUT -p udp --dport 53 -j ACCEPT
ip6tables -t filter -A INPUT -p tcp --dport 53 -j ACCEPT
ip6tables -t filter -A INPUT -p udp --dport 53 -j ACCEPT

# HTTP + HTTPS
iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 443 -j ACCEPT

ip6tables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT
ip6tables -t filter -A INPUT -p tcp --dport 443 -j ACCEPT
ip6tables -t filter -A OUTPUT -p tcp --dport 80 -j ACCEPT
ip6tables -t filter -A OUTPUT -p tcp --dport 443 -j ACCEPT

# IMAP SMTP
iptables -t filter -A INPUT -p tcp --dport 993 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 587 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 25 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 993 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 587 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 25 -j ACCEPT

ip6tables -t filter -A INPUT -p tcp --dport 993 -j ACCEPT
ip6tables -t filter -A INPUT -p tcp --dport 587 -j ACCEPT
ip6tables -t filter -A INPUT -p tcp --dport 25 -j ACCEPT
ip6tables -t filter -A OUTPUT -p tcp --dport 993 -j ACCEPT
ip6tables -t filter -A OUTPUT -p tcp --dport 587 -j ACCEPT
ip6tables -t filter -A OUTPUT -p tcp --dport 25 -j ACCEPT

sudo chmod +x parefeu

sudo -s
./parefeu

iptables -L
ip6tables -L

apt install iptables-persistent

iptables-save > /etc/iptables/rules.v4
ip6tables-save > /etc/iptables/rules.v6
iptables-restore < /etc/iptables/rules.v4
ip6tables-restore < /etc/iptables/rules.v6

dpkg-reconfigure iptables-persistent

apt install cron-apt

	grep security /etc/apt/sources.list > /etc/apt/security.sources.list

APTCOMMAND=/usr/bin/apt-get
OPTIONS="-o quiet=1 -o Dir::Etc::SourceList=/etc/apt/security.sources.list"
MAILTO="hostmaster@xoyize.xyz"
MAILON="always"

nano /etc/cron-apt/action.d/3-download

dist-upgrade -y -o APT::Get::Show-Upgraded=true

CRON-APT RUN [/etc/cron-apt/config]: Tue Feb 20 07:48:32 CET 2018
CRON-APT ACTION: 0-update
CRON-APT LINE: /usr/bin/apt-get -o quiet=1 -o Dir::Etc::SourceList=/etc/apt/security.sources.list update -o quiet=2
CRON-APT ACTION: 3-download
CRON-APT LINE: /usr/bin/apt-get -o quiet=1 -o Dir::Etc::SourceList=/etc/apt/security.sources.list autoclean -y
Reading package lists...
Building dependency tree...
Reading state information...
CRON-APT LINE: /usr/bin/apt-get -o quiet=1 -o Dir::Etc::SourceList=/etc/apt/security.sources.list dist-upgrade -y -o APT::Get::Show-Upgraded=true
Reading package lists...
Building dependency tree...
Reading state information...
Calculating upgrade...
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

dig +short MX xoyize.xyz
	10 xoyize.xyz.

/etc/ssl/private/xoyize.xyz-fullchain.pem
/etc/ssl/private/xoyize.xyz-key.pem
/etc/ssl/private/xoyize.xyz-chain.pem
/etc/ssl/private/xoyize.xyz-ca.pem

sudo -s

apt install postfix postfix-mysql -y

Configuration type du serveur de messagerie : Site Internet
Nom de courrier : xoyize.xyz

openssl dhparam -out /etc/postfix/dh_2048.pem -2 -rand /var/run/egd-pool 2048 # on peur coder 2048 au lieu de 1024
openssl dhparam -out /etc/postfix/dh_512.pem -2 -rand /var/run/egd-pool 512

mysql -u root -p

cd /var/www
wget 'http://sourceforge.net/projects/postfixadmin/files/postfixadmin/postfixadmin-3.1/postfixadmin-3.1.tar.gz/download' -O pfa.tar.gz
tar -zxvf pfa.tar.gz
mv postfixadmin-3.1 pfa
rm pfa.tar.gz
chown -R www-data. pfa
cd pfa

<?php
$CONF['configured'] = true;
$CONF['database_type'] = 'mysqli';
$CONF['database_host'] = 'localhost';
$CONF['database_user'] = 'postfix';
$CONF['database_password'] = 'iq9awn3wEuUPxsi6qrdU';
$CONF['database_name'] = 'postfix';
$CONF['admin_email'] = 'admin@xoyize.xyz';
$CONF['domain_path'] = 'YES';
$CONF['domain_in_mailbox'] = 'NO';
$CONF['fetchmail'] = 'NO';
$CONF['encrypt'] = 'md5crypt';
?>

chown www-data.www-data /var/www/pfa/config.local.php

mkdir -p /var/www/pfa/templates_c
chown -R www-data: /var/www/pfa/templates_c/

$CONF['setup_password'] = 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX';

cp /etc/postfix/main.cf /etc/postfix/main.cf.bak
nano /etc/postfix/main.cf

# Règles sur les adresses de destination
# permit_sasl_authenticated : Accepter la connexion lorsque le client est authentifié
# reject_non_fqdn_recipient : Refuser les adresses de destinations invalides (non FQDN)
smtpd_recipient_restrictions =
     permit_mynetworks,
     permit_sasl_authenticated,
     reject_non_fqdn_recipient,
     reject_unauth_destination,
     reject_unknown_recipient_domain,
     reject_rbl_client zen.spamhaus.org

# Règles sur l'échange HELO qui survient avant la connexion
# reject_invalid_helo_hostname : Refuser les échanges HELO invalides
# reject_non_fqdn_helo_hostname : Refuser les noms d'hôte invalides (non FQDN)
# reject_unknown_helo_hostname : Refuser les noms d'hôte qui n'ont pas de champ DNS A ou MX dans leurs DNS.
smtpd_helo_restrictions =
     permit_mynetworks,
     permit_sasl_authenticated,
     reject_invalid_helo_hostname,  

     reject_non_fqdn_helo_hostname,
     # reject_unknown_helo_hostname   

# Règles de connexion des clients
# permit_sasl_authenticated : Accepter la connexion lorsque le client est authentifié
# reject_plaintext_session : Refuser les connexions non sécurisées
# reject_unauth_pipelining : Refuser les défauts lors de la connexion
smtpd_client_restrictions =
     permit_mynetworks,
     permit_inet_interfaces,
     permit_sasl_authenticated,   
     # reject_plaintext_session,    
     # reject_unauth_pipelining     

# Règles sur les expéditeurs
# reject_non_fqdn_sender : Refuser les expéditeurs invalides (non FQDN)
# reject_unknown_sender_domain : Refuser les expéditeurs qui n'ont pas de champ DNS A ou MX dans leurs DNS.
# reject_sender_login_mismatch : Refuser les expéditeurs locaux non authentifiés
smtpd_sender_restrictions =
     reject_non_fqdn_sender,      

     reject_unknown_sender_domain,
     reject_sender_login_mismatch

# Smtp ( OUTGOING / Client )
smtp_tls_loglevel            = 1
smtp_tls_security_level      = may
smtp_tls_CAfile              = /etc/ssl/private/xoyize.xyz-ca.pem
smtp_tls_protocols           = !SSLv3
smtp_tls_mandatory_protocols = !SSLv3
smtp_tls_mandatory_ciphers   = high
smtp_tls_exclude_ciphers     = aNULL, eNULL, EXPORT, DES, 3DES, RC2, RC4, MD5, PSK, SRP, DSS, AECDH, ADH
smtp_tls_note_starttls_offer = yes

# ---------------------------------------------------------------------------------------------------

# Smtpd ( INCOMING / Server )
smtpd_tls_loglevel            = 1
smtpd_tls_auth_only           = yes
smtpd_tls_security_level      = may
smtpd_tls_received_header     = yes
smtpd_tls_protocols           = !SSLv3
smtpd_tls_mandatory_protocols = !SSLv3
smtpd_tls_mandatory_ciphers   = medium

# Infos (voir : postconf -d)
# Medium cipherlist = aNULL:-aNULL:ALL:!EXPORT:!LOW:+RC4:@STRENGTH
# High cipherlist   = aNULL:-aNULL:ALL:!EXPORT:!LOW:!MEDIUM:+RC4:@STRENGTH

# smtpd_tls_exclude_ciphers   = NE PAS modifier cette directive pour des raisons de compatibilité
#                               avec les autres serveurs de mail afin d'éviter une erreur du type
#                               "no shared cipher" ou "no cipher overlap" puis un fallback en
#                               plain/text...
# smtpd_tls_cipherlist        = Ne pas modifier non plus !

smtpd_tls_CAfile              = $smtp_tls_CAfile
smtpd_tls_cert_file           = /etc/ssl/private/xoyize.xyz-chain.pem
smtpd_tls_key_file            = /etc/ssl/private/xoyize.xyz-key.pem
smtpd_tls_dh1024_param_file   = $config_directory/dh2048.pem
smtpd_tls_dh512_param_file    = $config_directory/dh512.pem

tls_preempt_cipherlist = yes
tls_random_source      = dev:/dev/urandom

smtp_tls_session_cache_database  = btree:${data_directory}/smtp_scache
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
lmtp_tls_session_cache_database  = btree:${data_directory}/lmtp_scache

# Paramètres de connexion SASL
# C'est ici que l'on déclare Dovecot comme une passerelle pour authentifier les utilisateurs.
# Postfix peut s'appuyer sur Dovecot pour identifier les connexions SMTP.
smtpd_sasl_auth_enable          = yes
smtpd_sasl_type                 = dovecot
smtpd_sasl_path                 = private/auth
smtpd_sasl_security_options     = noanonymous
smtpd_sasl_tls_security_options = $smtpd_sasl_security_options
smtpd_sasl_local_domain         = $mydomain
smtpd_sasl_authenticated_header = yes

broken_sasl_auth_clients = yes

virtual_uid_maps        = static:5000
virtual_gid_maps        = static:5000
virtual_minimum_uid     = 5000
virtual_mailbox_base    = /var/mail

virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_mailbox_maps    = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_alias_maps      = mysql:/etc/postfix/mysql-virtual-alias-maps.cf

smtpd_sender_login_maps  = mysql:/etc/postfix/mysql-sender-login-maps.cf

virtual_transport = lmtp:unix:private/dovecot-lmtp

smtpd_banner         = $myhostname ESMTP $mail_name (Debian/GNU)
biff                 = no
append_dot_mydomain  = no
readme_directory     = no
delay_warning_time   = 4h
mailbox_command      = procmail -a "$EXTENSION"
recipient_delimiter  = +
disable_vrfy_command = yes
message_size_limit   = 502400000
mailbox_size_limit   = 1024000000

inet_interfaces = all
inet_protocols = ipv4

myhostname    = xoyize.xyz
myorigin      = xoyize.xyz
mydestination = localhost localhost.$mydomain
mynetworks    = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
relayhost     =

alias_maps     = hash:/etc/aliases
alias_database = hash:/etc/aliases

nano /etc/postfix/mysql-virtual-mailbox-domains.cf

hosts = 127.0.0.1
user = postfix
password = iq9awn3wEuUPxsi6qrdU
dbname = postfix

query = SELECT domain FROM domain WHERE domain='%s' and backupmx = 0 and active = 1

nano /etc/postfix/mysql-virtual-mailbox-maps.cf

hosts = 127.0.0.1
user = postfix
password = iq9awn3wEuUPxsi6qrdU
dbname = postfix

query = SELECT maildir FROM mailbox WHERE username='%s' AND active = 1

nano /etc/postfix/mysql-virtual-alias-maps.cf

hosts = 127.0.0.1
user = postfix
password = iq9awn3wEuUPxsi6qrdU
dbname = postfix

query = SELECT goto FROM alias WHERE address='%s' AND active = 1

nano /etc/postfix/mysql-sender-login-maps.cf

hosts = 127.0.0.1
user = postfix
password = iq9awn3wEuUPxsi6qrdU
dbname = postfix

query = SELECT username FROM mailbox WHERE username='%s' AND active = 1

submission inet n       -       -       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_dh1024_param_file=/etc/postfix/dh_2048.pem
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject

smtp  inet  n       -       -       -       -       smtpd

apt install dovecot-core dovecot-imapd dovecot-lmtpd dovecot-mysql -y

nano /etc/dovecot/dovecot.conf

!include_try /usr/share/dovecot/protocols.d/*.protocol
protocols = imap lmtp
listen = *

# Assurez-vous que cette ligne est bien décommentée :
!include conf.d/*.conf

nano /etc/dovecot/conf.d/10-mail.conf

# Le contenur local est organisé de cette manière :
# /var/mail/vhosts/xoyize.xyz/utilisateur
mail_location = maildir:/var/mail/vhosts/%d/%n/mail
maildir_stat_dirs=yes

namespace inbox {
    inbox = yes
}

mail_uid = 5000
mail_gid = 5000

first_valid_uid = 5000
last_valid_uid = 5000

mail_privileged_group = vmail

mkdir -p /var/mail/vhosts/xoyize.xyz

groupadd -g 5000 vmail
useradd -g vmail -u 5000 vmail -d /var/mail
chown -R vmail:vmail /var/mail

nano /etc/dovecot/conf.d/10-auth.conf

disable_plaintext_auth = yes
auth_mechanisms = plain login
#!include auth-system.conf.ext # Commenter cette ligne
!include auth-sql.conf.ext     # décommenter cette ligne

nano /etc/dovecot/conf.d/auth-sql.conf.ext

# Le mot de passe est obtenu à partir de la base de donnée
passdb {
  driver = sql
  args = /etc/dovecot/dovecot-sql.conf.ext
}

# Par contre le nom d'utilisateur est obtenu de manière statique à partir du conteneur local
# %d = domaine.tld
# %n = utilisateur
userdb {
  driver = static
  args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n
}

nano/etc/dovecot/dovecot-sql.conf.ext

# Paramètres de connexion
driver = mysql
connect = host=127.0.0.1 dbname=postfix user=postfix password=iq9awn3wEuUPxsi6qrdU

# Permet de définir l'algorithme de hachage.
# Pour plus d'information: http://wiki2.dovecot.org/Authentication/PasswordSchemes
# /!\ ATTENTION : ne pas oublier de modifier le paramètre "$CONF['encrypt'] = 'md5crypt';" de PostfixAdmin
default_pass_scheme = MD5-CRYPT

# Requête de récupération du mot de passe du compte utilisateur
password_query = SELECT password FROM mailbox WHERE username = '%u'

chown -R vmail:dovecot /etc/dovecot
chmod -R o-rwx /etc/dovecot

nano /etc/dovecot/conf.d/10-master.conf

service imap-login {

  inet_listener imap {
    port = 143
  }

  inet_listener imaps {
    port = 993
    ssl = yes
  }

  service_count = 0

}

service imap {

}

service lmtp {

  # On autorise Postfix à transférer les emails dans le spooler de Dovecot via LMTP
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
      mode = 0600
      user = postfix
      group = postfix
  }

}

service auth {

  # On autorise Postfix à se connecter à Dovecot via LMTP
  unix_listener /var/spool/postfix/private/auth {
      mode = 0666
      user = postfix
      group = postfix
  }

  # On indique à Dovecot les permissions du conteneur local
  unix_listener auth-userdb {
      mode = 0600
      user = vmail
      group = vmail
  }

  user = dovecot

}

service auth-worker {

  user = vmail

}

nano /etc/dovecot/conf.d/10-ssl.conf

ssl = required
ssl_cert = </etc/ssl/private/xoyize.xyz-chain.pem
ssl_key = </etc/ssl/private/xoyize.xyz-key.pem
ssl_protocols = !SSLv2 !SSLv3
#ssl_protocols = !SSLv3
ssl_cipher_list = ALL:!aNULL:!eNULL:!LOW:!MEDIUM:!EXP:!RC2:!RC4:!DES:!3DES:!MD5:!PSK:!SRP:!DSS:!AECDH:!ADH:@STRENGTH
ssl_prefer_server_ciphers = yes # Dovecot > 2.2.x
ssl_dh_parameters_length = 4096 # Dovecot > 2.2.x

systemctl restart postfix dovecot

netstat -ptna

Proto Recv-Q Send-Q Adresse locale          Adresse distante        Etat        PID/Program name    
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN      6116/master         
tcp        0      0 0.0.0.0:993             0.0.0.0:*               LISTEN      6009/dovecot        
tcp        0      0 0.0.0.0:587             0.0.0.0:*               LISTEN      6116/master         
tcp        0      0 0.0.0.0:143             0.0.0.0:*               LISTEN      6009/dovecot        

nc xoyize.xyz 25
EHLO $hostname

250-xoyize.xyz
250-PIPELINING
250-SIZE 502400000
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

apt-get install opendkim opendkim-tools

nano /etc/opendkim.conf

AutoRestart             Yes
AutoRestartRate         10/1h
UMask                   002
Syslog                  Yes
SyslogSuccess           Yes
LogWhy                  Yes

OversignHeaders         From
AlwaysAddARHeader       Yes
Canonicalization        relaxed/simple

ExternalIgnoreList      refile:/etc/opendkim/TrustedHosts
InternalHosts           refile:/etc/opendkim/TrustedHosts
KeyTable                refile:/etc/opendkim/KeyTable
SigningTable            refile:/etc/opendkim/SigningTable

Mode                    sv
PidFile                 /var/run/opendkim/opendkim.pid
SignatureAlgorithm      rsa-sha256

UserID                  opendkim:opendkim

Socket                  local:/var/spool/postfix/opendkim/opendkim.sock

mkdir /var/spool/postfix/opendkim
chown opendkim: /var/spool/postfix/opendkim
usermod -aG opendkim postfix

nano /etc/postfix/main.cf

milter_protocol = 6
milter_default_action = accept
smtpd_milters = unix:/var/spool/postfix/opendkim/opendkim.sock
non_smtpd_milters = unix:/var/spool/postfix/opendkim/opendkim.sock

mkdir -p /etc/opendkim/keys

nano /etc/opendkim/TrustedHosts

127.0.0.1
localhost
::1
*.xoyize.xyz

nano /etc/opendkim/KeyTable

mail._domainkey.xoyize.xyz xoyize.xyz:mail:/etc/opendkim/keys/xoyize.xyz/mail.private

nano /etc/opendkim/SigningTable

*@xoyize.xyz mail._domainkey.xoyize.xyz

cd /etc/opendkim/keys
mkdir xoyize.xyz && cd xoyize.xyz

# Paramètres : -s [sélecteur] -d [nom de domaine] -b [taille de la clé]
opendkim-genkey -s mail -d xoyize.xyz -b 4096

chown opendkim:opendkim mail.private

ls -lX /etc/opendkim/keys/xoyize.xyz/

-rw------- 1 opendkim opendkim 3243 févr. 14 21:05 mail.private
-rw------- 1 root     root      850 févr. 14 21:05 mail.txt

cat mail.txt

cat mail.txt

mail._domainkey	IN	TXT	( "v=DKIM1; k=rsa; "
	  "p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA5tSGc+j5pLEuWeR4NIhDRPhwHUZll1/N3ajHF1wSttUVp/igdcpZTKTD7ccFmsY0l+72Q+rlnoCGGdhdw0ImRoPVZwBfSxvC3alw/YLLCEwpy+J/tXx2WOPdHM95TVbt0S/wVWpPxmr3mAIPO24R4NEf0yQdvktnB26UTcLBEMtqAEtEDLqrea/XM5HQMngWXAARy379H6mo1Y"
	  "ee3wUqYZPX+g8ljZZMpIlvaE0pjtVIZ0kV8/kXz0fa1XHanc6rTsF7/XxCLYJRAK6fcfO8u/Ro65uWNM3x8+WN1nkf/ojh8VN/0A5oUrlQVWba4OEXxCkbZTU7V+4okyyhAHV2+/c0qRsKRNj2YuPl3DmJ8/me/UBHbIEeji7kcBuVkgv0cakHolMbKWESBuuw1F5MPThQ3qbUcCI9mY4OtTnElk40DVXMenKwQ1EnqJZlHtj6XOo0/na4"
	  "epqH+rtUOXhan6ewd8XQvJk630Qi1FHzWmO7i4pb8Uo0EDrAQmPvCNsR+AttrIdK7Ry3xgKAUdSyfT2GXmtP3hpr4l2w0Qv0sXAkVzz9xF0OsUjb3pztdAKz9t9pHiIj3C5p0HQZTAr7oVAzjiDu6gntfoMzTB6mY6PKF2TYOBagu0AZAwgwuWb24zrGPXRPS8U01TlY6UVzFJbB+97i0Nim5jQmyf/r38cCAwEAAQ==" )  ; ----- DKIM key mail for domaine.tld

mail._domainkey	IN	TXT	( "v=DKIM1; k=rsa; p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA5tSGc+j5pLEuWeR4NIhDRPhwHUZll1/N3ajHF1wSttUVp/igdcpZTKTD7ccFmsY0l+72Q+rlnoCGGdhdw0ImRoPVZwBfSxvC3alw/YLLCEwpy+J/tXx2WOPdHM95TVbt0S/wVWpPxmr3mAIPO24R4NEf0yQdvktnB26UTcLBEMtqAEtEDLqrea/XM5HQMngWXAARy379H6mo1Yee3wUqYZPX+g8ljZZMpIlvaE0pjtVIZ0kV8/kXz0fa1XHanc6rTsF7/XxCLYJRAK6fcfO8u/Ro65uWNM3x8+WN1nkf/ojh8VN/0A5oUrlQVWba4OEXxCkbZTU7V+4okyyhAHV2+/c0qRsKRNj2YuPl3DmJ8/me/UBHbIEeji7kcBuVkgv0cakHolMbKWESBuuw1F5MPThQ3qbUcCI9mY4OtTnElk40DVXMenKwQ1EnqJZlHtj6XOo0/na4epqH+rtUOXhan6ewd8XQvJk630Qi1FHzWmO7i4pb8Uo0EDrAQmPvCNsR+AttrIdK7Ry3xgKAUdSyfT2GXmtP3hpr4l2w0Qv0sXAkVzz9xF0OsUjb3pztdAKz9t9pHiIj3C5p0HQZTAr7oVAzjiDu6gntfoMzTB6mY6PKF2TYOBagu0AZAwgwuWb24zrGPXRPS8U01TlY6UVzFJbB+97i0Nim5jQmyf/r38cCAwEAAQ==" )  ; ----- DKIM key mail for domaine.tld

systemctl restart postfix dovecot opendkim

@        IN      TXT     "v=spf1 a mx ip4:ADRESSE IP DE VOTRE SERVEUR ~all"
# OVH
600 IN TXT "v=spf1 a mx ip4:93.115.96.97 ip6:2a03:75c0:35:670d::1 ~all"

apt install opendmarc

nano /etc/opendmarc.conf

AutoRestart             Yes
AutoRestartRate         10/1h
UMask                   0002
Syslog                  true

AuthservID              "xoyize.xyz"
TrustedAuthservIDs      "xoyize.xyz"
IgnoreHosts             /etc/opendkim/TrustedHosts
IgnoreMailFrom          "xoyize.xyz"
RejectFailures          false

UserID                  opendmarc:opendmarc
PidFile                 /var/run/opendmarc/opendmarc.pid
Socket                  local:/var/spool/postfix/opendmarc/opendmarc.sock

mkdir /var/spool/postfix/opendmarc
chown opendmarc: /var/spool/postfix/opendmarc
usermod -aG opendmarc postfix

smtpd_milters = unix:/var/spool/postfix/opendkim/opendkim.sock, unix:/var/spool/postfix/opendmarc/opendmarc.sock

systemctl restart opendmarc postfix

apt install spamassassin spamc

smtp      inet  n       -       -       -       -       smtpd
   -o content_filter=spamassassin

spamassassin unix -     n       n       -       -       pipe
  user=debian-spamd argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}

systemctl restart postfix

rewrite_header Subject *****SPAM*****

report_safe 0
whitelist_auth *@xoyize.xyz

add_header all Report _REPORT_
add_header spam Flag _YESNOCAPS_
add_header all Status _YESNO_, score=_SCORE_ required=_REQD_ tests=_TESTS_ autolearn=_AUTOLEARN_ version=_VERSION_
add_header all Level _STARS(*)_
add_header all Checker-Version SpamAssassin _VERSION_ (_SUBVERSION_) on _HOSTNAME_

X-Spam-Report:
	* -5.0 RCVD_IN_DNSWL_HI RBL: Sender listed at http://www.dnswl.org/, high
	*      trust
	*      [66.45.63.27 listed in list.dnswl.org]
	* -3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
	*      cert-sa@returnpath.net
	*      [Return Path SenderScore Certified {formerly]
	[Bonded Sender} - <http://www.senderscorecertified.com>]
	* -2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
	*      safe-sa@returnpath.net
	*      [Return Path SenderScore Safe List (formerly]
	[Habeas Safelist) - <http://www.senderscorecertified.com>]
X-Spam-Status: No, score=-10.0 required=5.0 tests=RCVD_IN_DNSWL_HI,
	RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_SAFE autolearn=ham
	version=3.3.2
X-Spam-Level:
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on hostname.domain.tld

# If you're using systemd (default for jessie), the ENABLED setting is
# not used. Instead, enable spamd by issuing:
# systemctl enable spamassassin.service
# Change to "1" to enable spamd on systems using sysvinit:
ENABLED=0
# Cronjob
# Set to anything but 0 to enable the cron job to automatically update
# spamassassin's rules on a nightly basis
CRON=0

systemctl enable spamassassin.service
systemctl start spamassassin.service

crontab -e

# Mise à jour des règles de spamassassin
20 02 * * * /usr/bin/sa-update

# Auto-apprentissage de spam assassin avec utilisateur yan
30 02 * * * /usr/bin/sa-learn --ham /var/mail/vhosts/xoyize.xyz/yan/mail/cur/*
40 02 * * * /usr/bin/sa-learn --spam /var/mail/vhosts/xoyize.xyz/yan/mail/.Spam/cur/*

OPTIONS="--create-prefs --max-children 5 --helper-home-dir -u debian-spamd"

chown debian-spamd -R /var/lib/spamassassin/.spamassassin

systemctl restart spamassassin

apt install dovecot-sieve dovecot-managesieved

nano /etc/dovecot/dovecot.conf

protocols = imap lmtp sieve

plugin {

sieve = /var/mail/vhosts/%d/%n/.dovecot.sieve
sieve_default = /var/mail/sieve/default.sieve
sieve_dir = /var/mail/vhosts/%d/%n/sieve
sieve_global_dir = /var/mail/sieve

}

mkdir /var/mail/sieve/
touch /var/mail/sieve/default.sieve && chown -R vmail:vmail /var/mail/sieve

require ["fileinto"];

if header :contains "Subject" "*****SPAM*****" {

fileinto "Spam";

}

sievec /var/mail/sieve/default.sieve

systemctl restart dovecot

XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X

apt install clamav-milter

MilterSocketGroup postfix
MilterSocketMode 660

mkdir /var/spool/postfix/clamav
chown clamav /var/spool/postfix/clamav

dpkg-reconfigure clamav-milter

Faut-il gérer le fichier de configuration automatiquement ?	Oui
Identifiant qui exécutera clamav-milter :			clamav
Groupes de clamav-milter (séparés par des espaces) : 		laisser le champ vide
Interface de communication avec Sendmail :			/var/spool/postfix/clamav/clamav-milter.ctl
Groupe propriétaire du fichier « socket » de clamav-milter :	clamav
Autorisations du fichier « socket » de clamav-milter :		666
Faut-il supprimer la « socket » résiduelle après un arrêt brutal ?	Oui
Délai d'expiration pour les données provenant de clamd :	120
Faut-il interdire à clamav-milter de créer des processus fils (« fork ») ?	No
Répertoire de l'environnement d'exécution sécurisé :		laisser le champ vide
Fichier PID :							/var/run/clamav/clamav-milter.pid
Chemin des répertoires temporaires :				/tmp
« Socket » de clamd à utiliser pour le traitement :		unix:/var/spool/postfix/clamav/clamav-milter.ctl
Hôtes à exclure de la vérification :				laisser le champ vide
Liste blanche d'adresses de courriel : 				laisser le champ vide
Action à réaliser pour un courriel « infecté » :		Rejeter
Action à réaliser en cas d'erreur :				Différer
Motif de rejet des courriels infectés :				Rejecting harmful e-mail: %v found.
Faut-il ajouter des en-têtes aux courriels vérifiés ?		Remplacer
Fichier de journal de clamav-milter : 				/var/log/clamav/clamav-milter.log
Faut-il désactiver le verrouillage du fichier de journal ? 	Non
Taille maximale (en Mo) du fichier de journal :			0
Faut-il ajouter des informations temporelles dans le fichier de journal pour chaque courriel ? Oui
Faut-il utiliser le système de journalisation syslog ?		Non
Type des messages syslog :					LOG_LOCAL6
Faut-il activer la journalisation bavarde ? 			Non
Niveau d'information à journaliser pour les messages infectés :	Désactivé
Niveau d'information à journaliser en l'absence d'alerte :	Désactivé
Taille maximale (en Mo) des fichiers à vérifier :		25
Voulez-vous que clamav-milter gère plusieurs destinataires ? 	Non
Souhaitez-vous activer la rotation des journaux ?		Oui

 service clamav-daemon start

postconf -e 'smtpd_milters = unix:/clamav/clamav-milter.ctl'
postfix reload

apt install clamav-testfiles swaks

DatabaseMirror db.fr.clamav.net

crontab -e

service clamav-daemon restart

smtpd_milters = unix:/var/spool/postfix/opendkim/opendkim.sock, unix:/var/spool/postfix/opendmarc/opendmarc.sock, unix:/var/spool/postfix/clamav/clamav-milter.ctl

systemctl reload postfix

systemctl stop clamav-freshclam
freshclam

ClamAV update process started at Thu Feb 15 18:25:17 2018
Downloading main.cvd [100%]
main.cvd updated (version: 58, sigs: 4566249, f-level: 60, builder: sigmgr)
Downloading daily.cvd [100%]
daily.cvd updated (version: 24010, sigs: 1769510, f-level: 63, builder: neo)
Downloading bytecode.cvd [100%]
bytecode.cvd updated (version: 315, sigs: 75, f-level: 63, builder: raynman)
...

systemctl start clamav-freshclam

systemctl start clamav-daemon

chown -R clamav:clamav /var/lib/clamav
chown -R clamav:clamav /var/log/clamav

apt install fail2ban

nano /etc/fail2ban/fail2ban.conf

[Definition]

# Option: loglevel
# Notes.: Set the log level output.
#         CRITICAL
#         ERROR
#         WARNING
#         NOTICE
#         INFO
#         DEBUG
# Values: [ LEVEL ]  Default: ERROR
#
loglevel = INFO

# Option: logtarget
# Notes.: Set the log target. This could be a file, SYSLOG, STDERR or STDOUT.
#         Only one log target can be specified.
#         If you change logtarget from the default value and you are
#         using logrotate -- also adjust or disable rotation in the
#         corresponding configuration file
#         (e.g. /etc/logrotate.d/fail2ban on Debian systems)
# Values: [ STDOUT | STDERR | SYSLOG | FILE ]  Default: STDERR
#
logtarget = /var/log/fail2ban.log

# Option: socket
# Notes.: Set the socket file. This is used to communicate with the daemon. Do
#         not remove this file when Fail2ban runs. It will not be possible to
#         communicate with the server afterwards.
# Values: [ FILE ]  Default: /var/run/fail2ban/fail2ban.sock
#
socket = /var/run/fail2ban/fail2ban.sock

# Option: pidfile
# Notes.: Set the PID file. This is used to store the process ID of the
#         fail2ban server.
# Values: [ FILE ]  Default: /var/run/fail2ban/fail2ban.pid
#
pidfile = /var/run/fail2ban/fail2ban.pid

# Options: dbfile
# Notes.: Set the file for the fail2ban persistent data to be stored.
#         A value of ":memory:" means database is only stored in memory
#         and data is lost when fail2ban is stopped.
#         A value of "None" disables the database.
# Values: [ None :memory: FILE ] Default: /var/lib/fail2ban/fail2ban.sqlite3
dbfile = None

cp /etc/fail2ban/jail.conf  /etc/fail2ban/jail.local

nano /etc/fail2ban/jail.local

[INCLUDES]

before = paths-debian.conf

[DEFAULT]

ignoreip = 127.0.0.1/8
bantime  = 600
findtime  = 600
maxretry = 3
backend = auto
usedns = warn
logencoding = auto
filter = %(__name__)s

destemail = root@localhost
sender = root@localhost
mta = sendmail
protocol = tcp
chain = INPUT
port = 0:65535
fail2ban_agent = Fail2Ban/%(fail2ban_version)s

banaction = iptables-multiport
banaction_allports = iptables-allports
protocol="%(protocol)s", chain="%(chain)s"]
action_mw = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
            %(mta)s-whois[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]

action_mwl = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
             %(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]

action_xarf = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
             xarf-login-attack[service=%(__name__)s, sender="%(sender)s", logpath=%(logpath)s, port="%(port)s"]

action_cf_mwl = cloudflare[cfuser="%(cfemail)s", cftoken="%(cfapikey)s"]
                %(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]

action_blocklist_de  = blocklist_de[email="%(sender)s", service=%(filter)s, apikey="%(blocklist_de_apikey)s", agent="%(fail2ban_agent)s"]

action_badips = badips.py[category="%(__name__)s", banaction="%(banaction)s", agent="%(fail2ban_agent)s"]
action_badips_report = badips[category="%(__name__)s", agent="%(fail2ban_agent)s"]

action = %(action_)s

action = %(action_mw)s

action = %(action_mwl)s

#
# JAILS
#

# SSH
[sshd]

enabled = true
port    = 55026
logpath = %(sshd_log)s
backend = %(sshd_backend)s

# Mail servers
[postfix]

enabled  = true
port     = smtp,ssmtp,submission
filter   = postfix
logpath  = /var/log/mail.log

[sasl]

enabled  = true
port     = smtp,ssmtp,submission,imap2,imap3,imaps,pop3,pop3s
filter   = postfix-sasl
# You might consider monitoring /var/log/mail.warn instead if you are
# running postfix since it would provide the same log lines at the
# "warn" level but overall at the smaller filesize.
logpath  = /var/log/mail.log

[dovecot]

enabled = true
port    = smtp,ssmtp,submission,imap2,imap3,imaps,pop3,pop3s
filter  = dovecot
logpath = /var/log/mail.log

# nginx
[nginx-http-auth]

enabled = true
port    = http,https
logpath = %(nginx_error_log)s

sytemctl restart fail2ban

sudo iptables -S

-P INPUT DROP
-P FORWARD DROP
-P OUTPUT ACCEPT
-N f2b-dovecot
-N f2b-nginx-http-auth
-N f2b-postfix
-N f2b-sasl
-N f2b-sshd
-A INPUT -p tcp -m multiport --dports 25,465,587 -j f2b-postfix
-A INPUT -p tcp -m multiport --dports 80,443 -j f2b-nginx-http-auth
-A INPUT -p tcp -m multiport --dports 55026 -j f2b-sshd
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p tcp -m tcp --dport 55026 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 55026 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A f2b-dovecot -j RETURN
-A f2b-nginx-http-auth -j RETURN
-A f2b-postfix -j RETURN
-A f2b-sasl -j RETURN
-A f2b-sshd -j RETURN

wget https://www.rainloop.net/repository/webmail/rainloop-community-latest.zip
mkdir /var/www/rainloop
unzip rainloop-community-latest.zip -d /var/www/rainloop
rm -rf rainloop-community-latest.zip

cd /var/www/rainloop
find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;
chown -R www-data:www-data .

mkdir -p /etc/nginx/conf.d/webmail.xoyize.xyz.d
nano /etc/nginx/conf.d/webmail.xoyize.xyz.conf

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name webmail.xoyize.xyz;

    ####    Locations
    # On cache les fichiers statiques
    location ~* \.(html|css|js|png|jpg|jpeg|gif|ico|svg|eot|woff|ttf)$ { expires max; }
    # On interdit les dotfiles
    location ~ /\. { deny all; }

    include ssl_params;
    include header_params;
    include dh_param;

    root /var/www/rainloop ;
    index index.php index.html index.htm;
        location ~ \.php$ {
           fastcgi_split_path_info ^(.+\.php)(/.+)$;
           fastcgi_pass unix:/run/php/php7.0-fpm.sock;    # PHP7.0
           fastcgi_index index.php;
           include fastcgi_params;
	   fastcgi_param SCRIPT_FILENAME $request_filename;
        }

    include conf.d/webmail.xoyize.xyz.d/*.conf;

    access_log /var/log/nginx/webmail.xoyize.xyz-access.log;
    error_log /var/log/nginx/webmail.xoyize.xyz-error.log;
}

systemctl restart nginx

tail -f /var/log/mail.log

admin yan

nano nano /var/www/rainloop/data/_data_/_default_/configs/application.ini

[logs]
; Enable logging
enable = On

IMAP  imap.xoyize.xyz ou xoyize.xyz 993  SSL/TLS   Normal Password
SMTP  smtp.xoyize.xyz ou xoyize.xyz 587  STARTTLS  Normal Password
Utilisateur yan@xoyize.xyz

openssl s_client -connect xoyize.xyz:587 -starttls smtp -tlsextdebug # Postfix

---
Certificate chain
 0 s:/CN=xoyize.xyz
   i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
 1 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
   i:/O=Digital Signature Trust Co./CN=DST Root CA X3
---

openssl s_client -connect xoyize.xyz:993 -tlsextdebug # Dovecot

* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN AUTH=LOGIN] Dovecot ready.

cd /var/www
wget https://download.nextcloud.com/server/releases/nextcloud-13.0.0.zip
unzip nextcloud-13.0.0.zip
mkdir /var/www/nextcloud/data
rm nextcloud-13.0.0.zip
useradd nextcloud --comment "limited nextcloud user" --no-create-home
chown -R nextcloud:www-data /var/www/nextcloud
chmod -R o-rwx /var/www/nextcloud

nano /etc/php/7.0/fpm/pool.d/nextcloud.conf

[nextcloud]

listen = /run/php/php7.0-fpm-nextcloud.sock

; Set permissions for unix socket, if one is used.
listen.owner = nextcloud
listen.group = www-data
listen.mode = 0660

; Unix user/group of processes.
user = nextcloud
group = www-data

pm = dynamic
pm.max_children = 6
pm.start_servers = 3
pm.min_spare_servers = 3
pm.max_spare_servers = 5
pm.max_requests = 500
pm.status_path = /fpm-status
ping.path = /ping
request_terminate_timeout = 1d
request_slowlog_timeout = 5s
slowlog = /var/log/nginx/nextcloud.slow.log
rlimit_files = 4096
rlimit_core = 0
chdir = /var/www/nextcloud/
catch_workers_output = yes
clear_env = no

php_value[upload_max_filesize] = 10G
php_value[post_max_size] = 10G
php_value[default_charset] = UTF-8

systemctl restart php7.0-fpm.service

nano /etc/nginx/conf.d/xoyize.xyz.d/nextcloud.conf

location ^~ /nextcloud {
  alias /var/www/nextcloud/;

  if ($scheme = http) {
    rewrite ^ https://$server_name$request_uri? permanent;
  }

    # Add headers to serve security related headers
    add_header                    X-Content-Type-Options nosniff;
    add_header                    X-XSS-Protection "1; mode=block";
    add_header                    X-Robots-Tag none;
    add_header                    X-Download-Options noopen;
    add_header                    X-Permitted-Cross-Domain-Policies none;
    add_header                    Strict-Transport-Security 'max-age=31536000; includeSubDomains;';

  # Set max upload size
  client_max_body_size 10G;
  fastcgi_buffers 64 4K;

  # Disable gzip to avoid the removal of the ETag header
  gzip off;

  # Errors pages
  error_page 403 /nextcloud/core/templates/403.php;
  error_page 404 /nextcloud/core/templates/404.php;

  # The following 2 rules are only needed for the user_webfinger app.
  # Uncomment it if you're planning to use this app.
  #rewrite ^/.well-known/host-meta /nextcloud/public.php?service=host-meta last;
  #rewrite ^/.well-known/host-meta.json /nextcloud/public.php?service=host-meta-json last;

  location /nextcloud {
    rewrite ^ /nextcloud/index.php$uri;
  }

  location = /nextcloud/robots.txt {
    allow all;
    log_not_found off;
    access_log off;
  }

  location ~ ^/nextcloud/(?:build|tests|config|lib|3rdparty|templates|data)/ {
    deny all;
  }
  location ~ ^/nextcloud/(?:\.|autotest|occ|issue|indie|db_|console) {
    deny all;
  }

  location ~ ^/nextcloud/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\.php(?:$|/) {
    include fastcgi_params;
    fastcgi_split_path_info ^(.+\.php)(/.+)$;
    fastcgi_param SCRIPT_FILENAME $request_filename;
    fastcgi_param PATH_INFO $fastcgi_path_info;
    fastcgi_param HTTPS on;
    fastcgi_param modHeadersAvailable true;
    fastcgi_param REMOTE_USER $remote_user;
    fastcgi_pass unix:/run/php/php7.0-fpm-nextcloud.sock;
    fastcgi_intercept_errors on;
  }

  location ~ ^/nextcloud/(?:updater|ocs-provider)(?:$|/) {
    try_files $uri/ =404;
    index index.php;
  }

  # Adding the cache control header for js and css files
  location ~* \.(?:css|js)$ {
    add_header Cache-Control "public, max-age=7200";
    # Add headers to serve security related headers
    add_header Strict-Transport-Security "max-age=15768000;";
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Robots-Tag none;
    add_header X-Download-Options noopen;
    add_header X-Permitted-Cross-Domain-Policies none;
    # Optional: Don't log access to assets
    access_log off;
  }

  location ~* \.(?:svg|gif|png|html|ttf|woff|ico|jpg|jpeg)$ {
    # Optional: Don't log access to other assets
    access_log off;
  }

}

nginx -t
	nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
	nginx: configuration file /etc/nginx/nginx.conf test is successful

systemctl restart php7.0-fpm nginx

Avertissements de sécurité & configuration

Il est important pour la sécurité et la performance de votre instance que tout soit configuré correctement. Pour vous aider dans cette tâche, nous faisons des vérifications automatiques. Veuillez consulter la section Trucs et Astuces et la documentation pour plus d'informations.

x Tous les tests ont réussi.

upstream php-handler {
    #server 127.0.0.1:9000;
    server unix:/run/php/php7.0-fpm-nextcloud.sock;    # PHP7.0
}

server {
    listen 80;
    listen [::]:80;
    server_name nc.xoyize.xyz;
    # enforce https
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name nc.xoyize.xyz;

    include ssl_params;
    include dh_param;

    # Add headers to serve security related headers
    # Before enabling Strict-Transport-Security headers please read into this
    # topic first.
    # add_header Strict-Transport-Security "max-age=15768000;
    # includeSubDomains; preload;";
    #
    # WARNING: Only add the preload option once you read about
    # the consequences in https://hstspreload.org/. This option
    # will add the domain to a hardcoded list that is shipped
    # in all major browsers and getting removed from this list
    # could take several months.
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Robots-Tag none;
    add_header X-Download-Options noopen;
    add_header X-Permitted-Cross-Domain-Policies none;

    # Path to the root of your installation
    root /var/www/nextcloud/;

    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }

    # The following 2 rules are only needed for the user_webfinger app.
    # Uncomment it if you're planning to use this app.
    #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
    #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json
    # last;

    location = /.well-known/carddav {
      return 301 $scheme://$host/remote.php/dav;
    }
    location = /.well-known/caldav {
      return 301 $scheme://$host/remote.php/dav;
    }

    # set max upload size
    client_max_body_size 512M;
    fastcgi_buffers 64 4K;

    # Enable gzip but do not remove ETag headers
    gzip on;
    gzip_vary on;
    gzip_comp_level 4;
    gzip_min_length 256;
    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
    gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;

    # Uncomment if your server is build with the ngx_pagespeed module
    # This module is currently not supported.
    #pagespeed off;

    location / {
        rewrite ^ /index.php$uri;
    }

    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
        deny all;
    }
    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
        deny all;
    }

    location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) {
        fastcgi_split_path_info ^(.+\.php)(/.*)$;
        include fastcgi_params;
        #fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
         fastcgi_param SCRIPT_FILENAME $request_filename;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param HTTPS on;
        #Avoid sending the security headers twice
        fastcgi_param modHeadersAvailable true;
         fastcgi_param REMOTE_USER $remote_user;
        fastcgi_param front_controller_active true;
        fastcgi_pass php-handler;
        fastcgi_intercept_errors on;
        fastcgi_request_buffering off;
    }

    location ~ ^/(?:updater|ocs-provider)(?:$|/) {
        try_files $uri/ =404;
        index index.php;
    }

    # Adding the cache control header for js and css files
    # Make sure it is BELOW the PHP block
    location ~ \.(?:css|js|woff|svg|gif)$ {
        try_files $uri /index.php$uri$is_args$args;
        add_header Cache-Control "public, max-age=15778463";
        # Add headers to serve security related headers (It is intended to
        # have those duplicated to the ones above)
        # Before enabling Strict-Transport-Security headers please read into
        # this topic first.
        # add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
        #
        # WARNING: Only add the preload option once you read about
        # the consequences in https://hstspreload.org/. This option
        # will add the domain to a hardcoded list that is shipped
        # in all major browsers and getting removed from this list
        # could take several months.
        add_header X-Content-Type-Options nosniff;
        add_header X-XSS-Protection "1; mode=block";
        add_header X-Robots-Tag none;
        add_header X-Download-Options noopen;
        add_header X-Permitted-Cross-Domain-Policies none;
        # Optional: Don't log access to assets
        access_log off;
    }

    location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ {
        try_files $uri /index.php$uri$is_args$args;
        # Optional: Don't log access to other assets
        access_log off;
    }
}

  'trusted_domains' => 
  array (
    0 => 'nc.xoyize.xyz',
  ),
  'datadirectory' => '/var/www/nextcloud/data',
  'overwrite.cli.url' => 'https://nc.xoyize.xyz',

nginx -t
systemctl restart nginx