KVM8 Core 4 Ram 8Go SSD 40Go Debian Stretch cinay.pw

ssh root@93.113.206.145

apt update && apt upgrade

apt install rsync curl tmux jq figlet git mailutils dnsutils -y

hostnamectl set-hostname --static vps27199

nano /etc/hosts

127.0.0.1       localhost
93.113.206.145  cinay.pw vps27199


# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

hostname
	vps27199
hostname --fqdn
	cinay.pw

dpkg-reconfigure locales

dpkg-reconfigure tzdata

Current default time zone: 'Europe/Paris'
Local time is now:      Wed Mar 14 13:26:39 CET 2018.
Universal Time is now:  Wed Mar 14 12:26:39 UTC 2018.

useradd -m -d /home/adxo/ -s /bin/bash adxo

passwd adxo

passwd root

ssh adxo@93.113.206.145

ssh-keygen -t ed25519 -o -a 100 -f ~/.ssh/kvm-vps-27199

scp ~/.ssh/kvm-vps-27199.pub adxo@93.113.206.145:/home/adxo/

ssh adxo@93.113.206.145

cd ~

chmod 600 /home/$USER/.ssh/authorized_keys

rm /home/$USER/kvm-vps-27199.pub

sudo nano /etc/ssh/sshd_config

sudo apt-get install libpam-systemd                #Installer par défaut sur debian stretch

sudo systemctl restart sshd

ssh -p 55027 -i ~/.ssh/kvm-vps-27199 adxo@93.113.206.145

nano ~/.ssh/rc

sudo rm /etc/motd

sudo gpasswd -a $USER systemd-journal

sudo gpasswd -a $USER adm

journalctl

export SYSTEMD_LESS=FRXMK journalctl

echo "export SYSTEMD_LESS=FRXMK journalctl" >> ~/.bashrc

sudo apt install rsync # debian

sudo useradd backupuser -c "limited backup user" -m -u 4210

sudo mkdir /home/backupuser/.ssh

sudo nano /home/backupuser/.ssh/authorized_keys

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCrIKzB0NZOO8/XNLHWeYiZr0Yt/OW1KFvYXVO5GBcj7Ckpha95F5j5tCZxLZoY4PmbfMlN7h89QfshqnDrTpB9tTrcAbLVC3084xAUnC53B6wj6jXEn7OkNo/SOCAHTwqESq4qzARTjkwIw3uPFuqbN0LkZXg8CX61XliMxDNXFddLlwQoGDEz73ZHcKjsrGXZXUMG7obxNCbHt9zg29Widc+8mZuPM2u5YvtjV/1MHnU9GmeXBI3tKziihAnPkmRwoVPUcuEhzZLCKO98M1SDtKQs47sDwQVptqX1WVYDVeMt8vfkF8Uxj5294cB07MKB6cjVmVrQlfxf+EdGLcAR yann@shuttle

sudo nano /home/backupuser/rsync-wrapper.sh

sudo chown backupuser:backupuser /home/backupuser/rsync-wrapper.sh
sudo chmod 755 /home/backupuser/rsync-wrapper.sh

sudo -s

echo "backupuser ALL=NOPASSWD: /usr/bin/rsync" >> /etc/sudoers
exit

/etc/network/interfaces

# Generate by postinstall at 2018-03-12 11:43:34
auto lo
iface lo inet loopback

auto eth0
iface eth0 inet static
        address 93.113.206.145
        netmask 255.255.255.0
        network 93.113.206.0
        broadcast 93.113.206.255
        gateway 93.113.206.1


iface eth0 inet6 static
        address 2a03:75c0:39:6a3f::1
        netmask 64
        gateway fe80::1
        post-up ip route add default via fe80::1 dev eth0

sudo mkdir -p /etc/nginx/conf.d/cinay.pw.d

sudo mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/cinay.pw.conf

sudo nano /etc/nginx/conf.d/cinay.pw.conf

server {
    listen 80;
    listen [::]:80;
    root /var/www/ ;
        location ~ \.php$ {
           fastcgi_split_path_info ^(.+\.php)(/.+)$;
           fastcgi_pass unix:/run/php/php7.0-fpm.sock;    # PHP7.0
           fastcgi_index index.php;
           include fastcgi_params;
           fastcgi_param SCRIPT_FILENAME $request_filename;
        }

    include conf.d/cinay.pw.d/*.conf;

    access_log /var/log/nginx/cinay.pw.log;
    error_log /var/log/nginx/cinay.pw.log;
}

sudo nginx -t

sudo systemctl reload nginx

sudo systemctl enable nginx

sudo apt install mariadb-server -y

sudo mysql_secure_installation

Enter current password for root (enter for none):
Set root password? [Y/n] y
Remove anonymous users? [Y/n] y
Disallow root login remotely? [Y/n] y
Remove test database and access to it? [Y/n] y
Reload privilege tables now? [Y/n] y

sudo -s # ou su

apt remove --purge bind* -y
rm -r /var/cache/bind/

apt install dnsutils unbound -y

cd /var/lib/unbound/ && wget ftp://ftp.internic.net/domain/named.cache

mv named.cache root.hints && chown unbound:unbound root.hints

server:
    # The following line will configure unbound to perform cryptographic
    # DNSSEC validation using the root trust anchor.
    auto-trust-anchor-file: "/var/lib/unbound/root.key"

server:
    # Send minimum amount of information to upstream servers to enhance
    # privacy. Only sends minimum required labels of the QNAME and sets
    # QTYPE to NS when possible.

    # See RFC 7816 "DNS Query Name Minimisation to Improve Privacy" for
    # details.

    qname-minimisation: yes

nano /etc/unbound/unbound.conf.d/dns-yan.conf

server:
 interface: 0.0.0.0
 interface: ::0
 access-control: 0.0.0.0/0 allow
 access-control: ::/0 allow
 root-hints: "/var/lib/unbound/root.hints"
 verbosity: 0
 #qname-minimisation: yes

 num-threads: 2
 msg-cache-slabs: 4
 rrset-cache-slabs: 4
 infra-cache-slabs: 4
 key-cache-slabs: 4
 rrset-cache-size: 100m
 msg-cache-size: 50m
 outgoing-range: 465
 so-rcvbuf: 4m
 so-sndbuf: 4m
 port: 53
 do-ip4: yes
 do-ip6: yes
 do-udp: yes
 do-tcp: yes
 do-daemonize: yes
 hide-identity: yes
 hide-version: yes
 harden-glue: yes
 harden-dnssec-stripped: yes
 harden-referral-path: yes
 use-caps-for-id: yes
 prefetch: yes

systemctl restart unbound

dig @127.0.0.1 afnic.fr +short +dnssec

192.134.5.25
A 8 2 600 20180406223409 20180307194345 64860 afnic.fr. lhw7AmNSkeZOtNN/9rJuGYxTdUcXSR3xlbsKz2xjNbFxQT5FwKILTW+E WWawrrbjo79uaG7kAvfMWrah4ijWtz9qGyd76qTr3XVdXB3+pbIsRr6X /I/ryQAy9w8tP3FvXHHU7IxihP+Ei2M5licCYitt1YZUyXuNFdNpdhq7 FRT+tq78yn1PEm121f32IRQ2Fjy9qZz9O0LU7roYZ6XFoPU9x3PU590J mpkywT9t6LpyeW5GK5zSL+Zb5eiFhfp33abkMf7b6Pc7xixcGN8h8SDQ Ry98Ne0EIqHKnyh/zzRszc1kBfP5kJXmcY/X3+4xLvKmvKNnBLT0dsn1 q1Hl1A==

apt install resolvconf -y
echo "nameserver 127.0.0.1" >> /etc/resolvconf/resolv.conf.d/head

nslookup afnic.fr | grep Server

Server:     127.0.0.1

dig @127.0.0.1 afnic.fr

; <<>> DiG 9.10.3-P4-Debian <<>> @127.0.0.1 afnic.fr
; (1 server found)
...
;; SERVER: 127.0.0.1#53(127.0.0.1)
...

nano /etc/unbound/dnsunbound-update-root-dns.sh

chmod +x /etc/unbound/dnsunbound-update-root-dns.sh

crontab -e

# Mise à jour automatique des serveurs DNS de la racine
50 02 * * * /etc/unbound/dnsunbound-update-root-dns.sh

cd ~
sudo -s  # en mode super utilisateur
apt install netcat -y  # prérequis
git clone https://github.com/Neilpang/acme.sh.git
cd acme.sh
./acme.sh --install # --nocron
cd ..
rm -rf acme.sh/

export OVH_AK="MyBRE3Oq2FZrLC2N"
export OVH_AS="U8rSfBLK0OYNRoeaCZvatqxUcf5aE8bj"

/root/.acme.sh/acme.sh --dns dns_ovh --issue --keylength 4096 -d cinay.pw -d smtp.cinay.pw -d imap.cinay.pw -d webmail.cinay.pw -d mail.cinay.pw -d nc.cinay.pw

/root/.acme.sh/acme.sh --dns dns_ovh --issue --keylength 4096 -d cinay.pw -d smtp.cinay.pw -d imap.cinay.pw -d webmail.cinay.pw -d mail.cinay.pw -d nc.cinay.pw

...
[mercredi 14 mars 2018, 14:17:27 (UTC+0100)] Your cert is in  /root/.acme.sh/cinay.pw/cinay.pw.cer
[mercredi 14 mars 2018, 14:17:27 (UTC+0100)] Your cert key is in  /root/.acme.sh/cinay.pw/cinay.pw.key
[mercredi 14 mars 2018, 14:17:27 (UTC+0100)] The intermediate CA cert is in  /root/.acme.sh/cinay.pw/ca.cer
[mercredi 14 mars 2018, 14:17:27 (UTC+0100)] And the full chain certs is there:  /root/.acme.sh/cinay.pw/fullchain.cer

ln -s /root/.acme.sh/cinay.pw/fullchain.cer /etc/ssl/private/cinay.pw-fullchain.pem     # full chain certs
ln -s /root/.acme.sh/cinay.pw/cinay.pw.key /etc/ssl/private/cinay.pw-key.pem            # cert key
ln -s /root/.acme.sh/cinay.pw/cinay.pw.cer /etc/ssl/private/cinay.pw-chain.pem          # cert
ln -s /root/.acme.sh/cinay.pw/ca.cer /etc/ssl/private/cinay.pw-ca.pem                   # intermediate CA cert

crontab -e

	44 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null

sudo nano /etc/nginx/ssl_params

    ssl_certificate /etc/ssl/private/cinay.pw-fullchain.pem;
    ssl_certificate_key /etc/ssl/private/cinay.pw-key.pem;
    ssl_session_timeout 5m;
    ssl_session_cache shared:SSL:50m;
    ssl_prefer_server_ciphers on;

    # Ciphers with intermediate compatibility
    # https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=nginx-1.6.2&openssl=1.0.1t&hsts=yes&profile=intermediate
    # ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    # ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';

    # Ciphers with modern compatibility
    # https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=nginx-1.6.2&openssl=1.0.1t&hsts=yes&profile=modern
    # Uncomment the following to use modern ciphers, but remove compatibility with some old clients (android before 5.0, Internet Explorer before 10, ...)
    ssl_protocols TLSv1.2;
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';

sudo nano /etc/nginx/header_params

    # Quelques explications https://www.alsacreations.com/article/lire/1723-tour-horizon-https-et-en-tetes-de-securite.html
    #HSTS est un dispositif de sécurité par lequel un site web peut déclarer aux navigateurs qu’ils doivent communiquer avec lui en utilisant exclusivement le protocole HTTPS, au lieu du HTTP
    add_header Strict-Transport-Security "max-age=31536000;";
    # Seul le site utilise peut utiliser iFrame
    add_header Content-Security-Policy "frame-ancestors 'self'";
    #se protéger contre le détournement de clic (clickjacking)
    add_header X-Frame-Options "SAMEORIGIN";
    # Empêche les navigateurs de détecter incorrectement les scripts qui ne sont pas des scripts
    add_header X-Content-Type-Options "nosniff";
    # Bloquer les pages à charger lorsqu'elles détectent des attaques XSS
    add_header X-XSS-Protection "1; mode=block";

    #Supprimer les ## des lignes  pour activer la fonction correspondante

    #CSP permet d’autoriser seulement les domaines déclarés à exécuter du script JavaScript, une feuille de style css, etc.
    # Content-Security-Policy : https://openweb.eu.org/articles/content-security-policy
    ## add_header Content-Security-Policy "default-src 'self'";

    # Désactiver les références pour les navigateurs qui ne prennent pas en charge strict-origin-when-cross-origin
    # Referrer-Policy : https://scotthelme.co.uk/a-new-security-header-referrer-policy/
    # Utilise strict-origin-when-cross-origin pour les navigateurs qui le font
    ## add_header Referrer-Policy "no-referrer, strict-origin-when-cross-origin";

openssl dhparam -out /etc/ssl/private/dh4096.pem -outform PEM -2 4096

sudo chmod 600 /etc/ssl/private/dh4096.pem

sudo nano /etc/nginx/dh_param

    # Uncomment the following directive after DH generation
    # > openssl dhparam -out /etc/ssl/private/dh4096.pem -outform PEM -2 4096
    ssl_dhparam /etc/ssl/private/dh4096.pem;

sudo nano /etc/nginx/conf.d/cinay.pw.conf

server {
    listen 80;
    listen [::]:80;

    ## redirect http to https ##
    return  301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name cinay.pw;

    ####    Locations
    # On cache les fichiers statiques
    location ~* \.(html|css|js|png|jpg|jpeg|gif|ico|svg|eot|woff|ttf)$ { expires max; }
    # On interdit les dotfiles
    location ~ /\. { deny all; }

    include ssl_params;
    include header_params;
    include dh_param;

    root /var/www/ ;
    index index.php index.html index.htm;
        location ~ \.php$ {
           fastcgi_split_path_info ^(.+\.php)(/.+)$;
           fastcgi_pass unix:/run/php/php7.0-fpm.sock;    # PHP7.0
           fastcgi_index index.php;
           include fastcgi_params;
	   fastcgi_param SCRIPT_FILENAME $request_filename;
        }

    include conf.d/cinay.pw.d/*.conf;

    access_log /var/log/nginx/cinay.pw-access.log;
    error_log /var/log/nginx/cinay.pw-error.log;
}

sudo nginx -t

sudo systemctl reload nginx

curl -I cinay.pw

HTTP/1.1 301 Moved Permanently
Server: nginx/1.13.9
Date: Mon, 12 Mar 2018 12:46:04 GMT
Content-Type: text/html
Content-Length: 185
Connection: keep-alive
Location: https:///

cd ~
sudo nano parefeu

sudo chmod +x parefeu

sudo -s
./parefeu

iptables -L
ip6tables -L

apt install iptables-persistent

dpkg-reconfigure iptables-persistent

dig +short MX cinay.pw
	10 cinay.pw.

/etc/ssl/private/cinay.pw-fullchain.pem
/etc/ssl/private/cinay.pw-key.pem
/etc/ssl/private/cinay.pw-chain.pem
/etc/ssl/private/cinay.pw-ca.pem

sudo -s

apt install postfix postfix-mysql -y

Configuration type du serveur de messagerie : Site Internet
Nom de courrier : cinay.pw

openssl dhparam -out /etc/postfix/dh_512.pem -2 -rand /var/run/egd-pool 512
openssl dhparam -out /etc/postfix/dh_2048.pem -2 -rand /var/run/egd-pool 2048 # on peur coder 2048 au lieu de 1024

mysql -u root -p

cd /var/www
wget 'http://sourceforge.net/projects/postfixadmin/files/postfixadmin/postfixadmin-3.1/postfixadmin-3.1.tar.gz/download' -O pfa.tar.gz
tar -zxvf pfa.tar.gz
mv postfixadmin-3.1 pfa
rm pfa.tar.gz
chown -R www-data. pfa
cd pfa

<?php
$CONF['configured'] = true;
$CONF['database_type'] = 'mysqli';
$CONF['database_host'] = 'localhost';
$CONF['database_user'] = 'postfix';
$CONF['database_password'] = 'iq9awn3wEuUPxsi6qrdU';
$CONF['database_name'] = 'postfix';
$CONF['admin_email'] = 'admin@cinay.pw';
$CONF['domain_path'] = 'YES';
$CONF['domain_in_mailbox'] = 'NO';
$CONF['fetchmail'] = 'NO';
$CONF['encrypt'] = 'md5crypt';
?>

chown www-data.www-data /var/www/pfa/config.local.php

mkdir -p /var/www/pfa/templates_c
chown -R www-data: /var/www/pfa/templates_c/

$CONF['setup_password'] = 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX';

cp /etc/postfix/main.cf /etc/postfix/main.cf.bak
nano /etc/postfix/main.cf

#######################
## Paramètres généraux
#######################
compatibility_level  = 2
smtpd_banner         = $myhostname ESMTP $mail_name (Debian/GNU)
biff                 = no
append_dot_mydomain  = no
readme_directory     = no
delay_warning_time   = 4h
mailbox_command      = procmail -a "$EXTENSION"
recipient_delimiter  = +
disable_vrfy_command = yes
message_size_limit   = 502400000
mailbox_size_limit   = 1024000000

inet_interfaces = all
inet_protocols = ipv4

myhostname    = cinay.pw
mydomain      = cinay.pw
mydestination = localhost
mynetworks    = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
relayhost     =

alias_maps     = hash:/etc/aliases
alias_database = hash:/etc/aliases

####################
## Paramètres TLS
####################
# Smtp ( OUTGOING / Client )
smtp_tls_loglevel            = 1
smtp_tls_security_level      = may
smtp_tls_CAfile              = /etc/ssl/private/cinay.pw-ca.pem
smtp_tls_protocols           = !SSLv3
smtp_tls_mandatory_protocols = !SSLv3
smtp_tls_mandatory_ciphers   = high
smtp_tls_exclude_ciphers     = aNULL, eNULL, EXPORT, DES, 3DES, RC2, RC4, MD5, PSK, SRP, DSS, AECDH, ADH
smtp_tls_note_starttls_offer = yes

# ---------------------------------------------------------------------------------------------------

# Smtpd ( INCOMING / Server )
smtpd_tls_loglevel            = 1
smtpd_tls_auth_only           = yes
smtpd_tls_security_level      = may
smtpd_tls_received_header     = yes
smtpd_tls_protocols           = !SSLv3
smtpd_tls_mandatory_protocols = !SSLv3
smtpd_tls_mandatory_ciphers   = medium

# Infos (voir : postconf -d)
# Medium cipherlist = aNULL:-aNULL:ALL:!EXPORT:!LOW:+RC4:@STRENGTH
# High cipherlist   = aNULL:-aNULL:ALL:!EXPORT:!LOW:!MEDIUM:+RC4:@STRENGTH

# smtpd_tls_exclude_ciphers   = NE PAS modifier cette directive pour des raisons de compatibilité
#                               avec les autres serveurs de mail afin d'éviter une erreur du type
#                               "no shared cipher" ou "no cipher overlap" puis un fallback en
#                               plain/text...
# smtpd_tls_cipherlist        = Ne pas modifier non plus !

smtpd_tls_CAfile              = $smtp_tls_CAfile
smtpd_tls_cert_file           = /etc/ssl/private/cinay.pw-chain.pem
smtpd_tls_key_file            = /etc/ssl/private/cinay.pw-key.pem
smtpd_tls_dh1024_param_file   = $config_directory/dh_2048.pem
smtpd_tls_dh512_param_file    = $config_directory/dh_512.pem

tls_preempt_cipherlist = yes
tls_random_source      = dev:/dev/urandom

smtp_tls_session_cache_database  = btree:${data_directory}/smtp_scache
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
lmtp_tls_session_cache_database  = btree:${data_directory}/lmtp_scache

###############################################################################################
## Paramètres de connexion SASL
## C'est ici que l'on déclare Dovecot comme une passerelle pour authentifier les utilisateurs.
## Postfix peut s'appuyer sur Dovecot pour identifier les connexions SMTP.
###############################################################################################
smtpd_sasl_auth_enable          = yes
smtpd_sasl_type                 = dovecot
smtpd_sasl_path                 = private/auth
smtpd_sasl_security_options     = noanonymous
smtpd_sasl_tls_security_options = $smtpd_sasl_security_options
smtpd_sasl_local_domain         = $mydomain
smtpd_sasl_authenticated_header = yes

broken_sasl_auth_clients = yes

##############################
## VIRTUALS MAPS PARAMETERS ##
##############################
# Gestion et du stockage des emails.
# Utilisateur "vmail" avec UID/GID de 5000, avec un HOME par défaut pointant sur "/var/mail".
# Postfix doit le savoir donc on lui indique avec les 4 paramètres suivants :
virtual_uid_maps        = static:5000
virtual_gid_maps        = static:5000
virtual_minimum_uid     = 5000
virtual_mailbox_base    = /var/mail

# Les 4 règles suivantes permettent à Postfix de savoir comment se connecter et lire la base de donnée
# afin de récupérer des informations sur les différents domaines, adresses virtuelles et alias.
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_mailbox_maps    = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_alias_maps      = mysql:/etc/postfix/mysql-virtual-alias-maps.cf
smtpd_sender_login_maps = mysql:/etc/postfix/mysql-sender-login-maps.cf

######################
## ERRORS REPORTING ##
######################

# notify_classes = bounce, delay, resource, software
notify_classes = resource, software

error_notice_recipient     = hostmaster@cinay.pw
# delay_notice_recipient   = admin@domain.tld
# bounce_notice_recipient  = admin@domain.tld
# 2bounce_notice_recipient = admin@domain.tld

###############################################################################################
## Règles sur les adresses de destination
## permit_sasl_authenticated : Accepter la connexion lorsque le client est authentifié
## reject_non_fqdn_recipient : Refuser les adresses de destinations invalides (non FQDN)
###############################################################################################
smtpd_recipient_restrictions =
     permit_mynetworks,
     permit_sasl_authenticated,
     reject_non_fqdn_recipient,
     reject_unauth_destination,
     reject_unknown_recipient_domain,
     reject_rbl_client zen.spamhaus.org

###############################################################################################
## Règles sur l'échange HELO qui survient avant la connexion
## reject_invalid_helo_hostname : Refuser les échanges HELO invalides
## reject_non_fqdn_helo_hostname : Refuser les noms d'hôte invalides (non FQDN)
## reject_unknown_helo_hostname : Refuser les noms d'hôte qui n'ont pas de champ DNS A ou MX dans leurs DNS.
###############################################################################################
smtpd_helo_restrictions =
     permit_mynetworks,
     permit_sasl_authenticated,
     reject_invalid_helo_hostname,  
     reject_non_fqdn_helo_hostname,
     # reject_unknown_helo_hostname   

###############################################################################################
## Règles de connexion des clients
## permit_sasl_authenticated : Accepter la connexion lorsque le client est authentifié
## reject_plaintext_session : Refuser les connexions non sécurisées
## reject_unauth_pipelining : Refuser les défauts lors de la connexion
###############################################################################################
smtpd_client_restrictions =
     permit_mynetworks,
     permit_inet_interfaces,
     permit_sasl_authenticated,   
     # reject_plaintext_session,    
     # reject_unauth_pipelining     

###############################################################################################
## Règles sur les expéditeurs
## reject_non_fqdn_sender : Refuser les expéditeurs invalides (non FQDN)
## reject_unknown_sender_domain : Refuser les expéditeurs qui n'ont pas de champ DNS A ou MX dans leurs DNS.
## reject_sender_login_mismatch : Refuser les expéditeurs locaux non authentifiés
###############################################################################################
smtpd_sender_restrictions =
     reject_non_fqdn_sender,      
     reject_unknown_sender_domain,
     #  reject_sender_login_mismatch
#----------------------------------------------------------------------------------------------

# Le paramètre "virtual_transport" est très très important, il permet à Postfix de savoir où envoyer les emails reçus.
# Dans notre cas, on utilise le protocole **LMTP** pour les acheminer jusqu'à Dovecot
virtual_transport = lmtp:unix:private/dovecot-lmtp

nano /etc/postfix/mysql-virtual-mailbox-domains.cf

hosts = 127.0.0.1
user = postfix
password = iq9awn3wEuUPxsi6qrdU
dbname = postfix

query = SELECT domain FROM domain WHERE domain='%s' and backupmx = 0 and active = 1

nano /etc/postfix/mysql-virtual-mailbox-maps.cf

hosts = 127.0.0.1
user = postfix
password = iq9awn3wEuUPxsi6qrdU
dbname = postfix

query = SELECT maildir FROM mailbox WHERE username='%s' AND active = 1

nano /etc/postfix/mysql-virtual-alias-maps.cf

hosts = 127.0.0.1
user = postfix
password = iq9awn3wEuUPxsi6qrdU
dbname = postfix

query = SELECT goto FROM alias WHERE address='%s' AND active = 1

nano /etc/postfix/mysql-sender-login-maps.cf

hosts = 127.0.0.1
user = postfix
password = iq9awn3wEuUPxsi6qrdU
dbname = postfix

query = SELECT username FROM mailbox WHERE username='%s' AND active = 1

nano /etc/postfix/master.cf

submission inet n       -       -       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_dh1024_param_file=/etc/postfix/dh_2048.pem
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject

#smtp      inet  n       -       y       -       -       smtpd
smtp      inet  n       -       -       -       -       smtpd

apt install dovecot-core dovecot-imapd dovecot-lmtpd dovecot-mysql -y

nano /etc/dovecot/dovecot.conf

# Enable installed protocols
!include_try /usr/share/dovecot/protocols.d/*.protocol
protocols = imap lmtp
listen = *

# Assurez-vous que cette ligne est bien décommentée :
!include conf.d/*.conf

nano /etc/dovecot/conf.d/10-mail.conf

##
## Mailbox locations and namespaces
##
# Le contenur local est organisé de cette manière :
mail_location = maildir:/var/mail/vhosts/%d/%n/mail
maildir_stat_dirs=yes

namespace inbox {
    inbox = yes
}

mail_uid = 5000
mail_gid = 5000

first_valid_uid = 5000
last_valid_uid = 5000

mail_privileged_group = vmail

mkdir -p /var/mail/vhosts/cinay.pw

groupadd -g 5000 vmail
useradd -g vmail -u 5000 vmail -d /var/mail
chown -R vmail:vmail /var/mail

nano /etc/dovecot/conf.d/10-auth.conf

##
## Authentication processes
##

disable_plaintext_auth = yes
auth_mechanisms = plain login
#!include auth-system.conf.ext # Commenter cette ligne
!include auth-sql.conf.ext     # décommenter cette ligne

nano /etc/dovecot/conf.d/auth-sql.conf.ext

# Authentication for SQL users. Included from 10-auth.conf.
#
# Le mot de passe est obtenu à partir de la base de donnée
passdb {
  driver = sql
  args = /etc/dovecot/dovecot-sql.conf.ext
}

# Par contre le nom d'utilisateur est obtenu de manière statique à partir du conteneur local
# %d = domaine.tld
# %n = utilisateur
userdb {
  driver = static
  args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n
}

nano /etc/dovecot/dovecot-sql.conf.ext

# Paramètres de connexion
driver = mysql
connect = host=127.0.0.1 dbname=postfix user=postfix password=iq9awn3wEuUPxsi6qrdU

# Permet de définir l'algorithme de hachage.
# Pour plus d'information: http://wiki2.dovecot.org/Authentication/PasswordSchemes
# /!\ ATTENTION : ne pas oublier de vérifier ou modifier le paramètre "$CONF['encrypt'] = 'md5crypt';" de PostfixAdmin
default_pass_scheme = MD5-CRYPT

# Requête de récupération du mot de passe du compte utilisateur
password_query = SELECT password FROM mailbox WHERE username = '%u'

chown -R vmail:dovecot /etc/dovecot
chmod -R o-rwx /etc/dovecot

nano /etc/dovecot/conf.d/10-master.conf

service imap-login {

  inet_listener imap {
    port = 143
  }

  inet_listener imaps {
    port = 993
    ssl = yes
  }

  service_count = 0

}

service imap {

}

service lmtp {

  # On autorise Postfix à transférer les emails dans le spooler de Dovecot via LMTP
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
      mode = 0600
      user = postfix
      group = postfix
  }

}

service auth {

  # On autorise Postfix à se connecter à Dovecot via LMTP
  unix_listener /var/spool/postfix/private/auth {
      mode = 0666
      user = postfix
      group = postfix
  }

  # On indique à Dovecot les permissions du conteneur local
  unix_listener auth-userdb {
      mode = 0600
      user = vmail
      group = vmail
  }

  user = dovecot

}

service auth-worker {

  user = vmail

}

nano /etc/dovecot/conf.d/10-ssl.conf

##
## SSL settings
##
ssl = required
ssl_cert = </etc/ssl/private/cinay.pw-chain.pem
ssl_key = </etc/ssl/private/cinay.pw-key.pem
#ssl_protocols = !SSLv2 !SSLv3
ssl_protocols = !SSLv3
ssl_cipher_list = ALL:!aNULL:!eNULL:!LOW:!MEDIUM:!EXP:!RC2:!RC4:!DES:!3DES:!MD5:!PSK:!SRP:!DSS:!AECDH:!ADH:@STRENGTH
ssl_prefer_server_ciphers = yes # Dovecot > 2.2.x
ssl_dh_parameters_length = 4096 # Dovecot > 2.2.x
#ssl_dh_parameters_length = 2048 # Dovecot > 2.2.x

systemctl restart postfix dovecot

netstat -ptna

Proto Recv-Q Send-Q Adresse locale          Adresse distante        Etat        PID/Program name    
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN      6116/master         
tcp        0      0 0.0.0.0:993             0.0.0.0:*               LISTEN      6009/dovecot        
tcp        0      0 0.0.0.0:587             0.0.0.0:*               LISTEN      6116/master         
tcp        0      0 0.0.0.0:143             0.0.0.0:*               LISTEN      6009/dovecot        

nc cinay.pw 25

220 cinay.pw ESMTP Postfix (Debian/GNU)

EHLO $hostname

250-cinay.pw
250-PIPELINING
250-SIZE 502400000
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

apt install -y lsb-release wget -y
wget -O- https://rspamd.com/apt-stable/gpg.key | apt-key add -
echo "deb http://rspamd.com/apt-stable/ $(lsb_release -c -s) main" > /etc/apt/sources.list.d/rspamd.list
echo "deb-src http://rspamd.com/apt-stable/ $(lsb_release -c -s) main" >> /etc/apt/sources.list.d/rspamd.list

apt update
apt install rspamd -y

systemctl stop rspamd

bind_socket = "127.0.0.1:11333";

bind_socket = "127.0.0.1:11332";
milter = yes;
timeout = 120s;
upstream "local" {
  default = yes;
  self_scan = yes;
}

rspamadm pw --encrypt -p P4ssvv0rD

type = "controller";
count = 1;
password = "$2$aib.........................bqxiy";
secure_ip = "127.0.0.1";
secure_ip = "::1";
static_dir = "${WWWDIR}";

servers = "127.0.0.1";
backend = "redis";

use = ["x-spamd-bar", "x-spam-level", "authentication-results"];

systemctl restart rspamd

mkdir /var/lib/rspamd/dkim/
rspamadm dkim_keygen -b 2048 -s 2018 -k /var/lib/rspamd/dkim/2018.key > /var/lib/rspamd/dkim/2018.txt
chown -R _rspamd:_rspamd /var/lib/rspamd/dkim
chmod 440 /var/lib/rspamd/dkim/*

cat /var/lib/rspamd/dkim/2018.txt

2018._domainkey IN TXT ( "v=DKIM1; k=rsa; "
        "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2/al5HqXUpe+HUazCr6t9lv2VOZLR369PPB4t+dgljZQvgUsIKoYzfS/w9NagS32xZYxi1dtlDWuRfTU/ahHO2MYzE0zHE4lMfwb6VkNCG+pM6bAkCwc5cFvyRygwxAPEiHAtmtU5b0i9LY25Z/ZWgyBxEWZ0Wf+hLjYHvnvMqewPsduUqKVjDOdUqeBb1VAu3WFErOAGVUYfKqFX"
        "+yfz36Alb7/OMAort8A5Vo5t5k0vxTHzkYYg5KB6tLS8jngrNucGjyNL5+k0ijPs3yT7WpTGL3U3SEa8cX8WvOO1fIpWQz4yyZJJ1Mm62+FskSc7BHjdiMHE64Id/UBDDVjxwIDAQAB"
) ;

path = "/var/lib/rspamd/dkim/$selector.key";
selector = "2018";

### Enable DKIM signing for alias sender addresses
allow_username_mismatch = true;

cp -R /etc/rspamd/local.d/dkim_signing.conf /etc/rspamd/local.d/arc.conf

apt install redis-server

servers = "127.0.0.1";

postconf -e "milter_protocol = 6"
postconf -e "milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}"
postconf -e "milter_default_action = accept"
postconf -e "smtpd_milters = inet:127.0.0.1:11332"
postconf -e "non_smtpd_milters = inet:127.0.0.1:11332"

##
## Spam filter and DKIM signatures via Rspamd
##

milter_protocol = 6
milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
milter_default_action = accept
smtpd_milters = inet:127.0.0.1:11332
non_smtpd_milters = inet:127.0.0.1:11332

systemctl restart postfix

apt install dovecot-sieve dovecot-managesieved

protocol lmtp {
  postmaster_address = postmaster@cinay.pw
  mail_plugins = $mail_plugins sieve
}

...
service managesieve-login {
  inet_listener sieve {
    port = 4190
  }
  ...
}
...
service managesieve {
  process_limit = 1024
}
...

...
protocol imap {
  ...
  #mail_plugins = $mail_plugins imap_quota imap_sieve
  mail_plugins = $mail_plugins imap_sieve
  ...
}
...

plugin {
    sieve_plugins = sieve_imapsieve sieve_extprograms
    sieve_before = /var/mail/sieve/default.sieve
    #sieve = file:/var/mail/sieve/%d/%n/scripts;active=/var/mail/sieve/%d/%n/active-script.sieve

    ###
    ### Spam learning
    ###
    # From elsewhere to Spam folder
    imapsieve_mailbox1_name = Spam
    imapsieve_mailbox1_causes = COPY
    imapsieve_mailbox1_before = file:/var/mail/sieve/learn-spam.sieve

    # From Spam folder to elsewhere
    imapsieve_mailbox2_name = *
    imapsieve_mailbox2_from = Spam
    imapsieve_mailbox2_causes = COPY
    imapsieve_mailbox2_before = file:/var/mail/sieve/learn-ham.sieve

    sieve_pipe_bin_dir = /usr/bin
    sieve_global_extensions = +vnd.dovecot.pipe

    #quota = maildir:User quota
    #quota_exceeded_message = Benutzer %u hat das Speichervolumen überschritten. / User %u has exhausted allowed storage space.
}

mkdir /var/mail/sieve/
touch /var/mail/sieve/default.sieve 

require ["fileinto"];

if header :contains "Subject" "***SPAM***" {
    fileinto "Spam";
}

if header :contains "X-Spam-Flag" "YES" {
    fileinto "Spam";
}

if header :is "X-Spam" "Yes" {
    fileinto "Spam";
}

require ["vnd.dovecot.pipe", "copy", "imapsieve"];
pipe :copy "rspamc" ["learn_spam"];

require ["vnd.dovecot.pipe", "copy", "imapsieve"];
pipe :copy "rspamc" ["learn_ham"];

sievec /var/mail/sieve/default.sieve
sievec /var/mail/sieve/learn-spam.sieve
sievec /var/mail/sieve/learn-ham.sieve
chown -R vmail:vmail /var/mail/sieve

systemctl restart dovecot

systemctl restart postfix dovecot rspamd

ssh -L 8080:localhost:11334 benutzer@mail.cinay.pw -N                          # sans clé
ssh -p 55027 -i ~/.ssh/kvm-vps-27199 -L 8080:localhost:11334 adxo@cinay.pw -N  # avec clé

/^Received:.*with ESMTPSA/  IGNORE
/^X-Originating-IP:/        IGNORE
/^X-Mailer:/                IGNORE
/^User-Agent:/              IGNORE

postconf -e "mime_header_checks = regexp:/etc/postfix/header_checks"
postconf -e "header_checks = regexp:/etc/postfix/header_checks"

postmap /etc/postfix/header_checks
systemctl reload postfix

apt install fail2ban

cp /etc/fail2ban/jail.conf  /etc/fail2ban/jail.local

nano /etc/fail2ban/jail.local

[INCLUDES]

before = paths-debian.conf

[DEFAULT]

ignoreip = 127.0.0.1/8
bantime  = 600
findtime  = 600
maxretry = 3
backend = auto
usedns = warn
logencoding = auto
filter = %(__name__)s

destemail = root@localhost
sender = root@localhost
mta = sendmail
protocol = tcp
chain = INPUT
port = 0:65535
fail2ban_agent = Fail2Ban/%(fail2ban_version)s

banaction = iptables-multiport
banaction_allports = iptables-allports
protocol="%(protocol)s", chain="%(chain)s"]
action_mw = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
            %(mta)s-whois[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]

action_mwl = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
             %(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]

action_xarf = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
             xarf-login-attack[service=%(__name__)s, sender="%(sender)s", logpath=%(logpath)s, port="%(port)s"]

action_cf_mwl = cloudflare[cfuser="%(cfemail)s", cftoken="%(cfapikey)s"]
                %(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]

action_blocklist_de  = blocklist_de[email="%(sender)s", service=%(filter)s, apikey="%(blocklist_de_apikey)s", agent="%(fail2ban_agent)s"]

action_badips = badips.py[category="%(__name__)s", banaction="%(banaction)s", agent="%(fail2ban_agent)s"]
action_badips_report = badips[category="%(__name__)s", agent="%(fail2ban_agent)s"]

action = %(action_)s

action = %(action_mw)s

action = %(action_mwl)s

#
# JAILS
#

# SSH
[sshd]

enabled = true
port    = 55027
logpath = %(sshd_log)s
backend = %(sshd_backend)s

# Mail servers
[postfix]

enabled  = true
port     = smtp,ssmtp,submission
filter   = postfix
logpath  = /var/log/mail.log

[sasl]

enabled  = true
port     = smtp,ssmtp,submission,imap2,imap3,imaps,pop3,pop3s
filter   = postfix-sasl
# You might consider monitoring /var/log/mail.warn instead if you are
# running postfix since it would provide the same log lines at the
# "warn" level but overall at the smaller filesize.
logpath  = /var/log/mail.log

[dovecot]

enabled = true
port    = smtp,ssmtp,submission,imap2,imap3,imaps,pop3,pop3s
filter  = dovecot
logpath = /var/log/mail.log

# nginx
[nginx-http-auth]

enabled = true
port    = http,https
logpath = %(nginx_error_log)s

systemctl restart fail2ban

iptables -S

-P INPUT DROP
-P FORWARD DROP
-P OUTPUT ACCEPT
-N f2b-dovecot
-N f2b-nginx-http-auth
-N f2b-postfix
-N f2b-sasl
-N f2b-sshd
-A INPUT -p tcp -m multiport --dports 25,465,587 -j f2b-postfix
-A INPUT -p tcp -m multiport --dports 80,443 -j f2b-nginx-http-auth
-A INPUT -p tcp -m multiport --dports 55027 -j f2b-sshd
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p tcp -m tcp --dport 55027 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 55027 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A f2b-dovecot -j RETURN
-A f2b-nginx-http-auth -j RETURN
-A f2b-postfix -j RETURN
-A f2b-sasl -j RETURN
-A f2b-sshd -j RETURN

IMAP  imap.cinay.pw ou cinay.pw 993  SSL/TLS   Mot de Passe Normal
SMTP  smtp.cinay.pw ou cinay.pw 587  STARTTLS  Mot de Passe Normal
Utilisateur yan@cinay.pw

oli.ovh.             3600  IN MX 10 cinay.pw.
oli.ovh.             3600  IN TXT   "v=spf1 include:cinay.pw ?all"
_dmarc.oli.ovh.      3600  IN TXT   "v=DMARC1; p=reject;"

xoyize.xyz.          3600  IN MX 10  cinay.pw.
xoyize.xyz.          3600  IN TXT    "v=spf1 include:cinay.pw ?all"
_dmarc.xoyize.xyz.   3600  IN TXT    "v=DMARC1"

CREATE DATABASE nextcloud;
GRANT ALL PRIVILEGES ON nextcloud.* TO 'nextcloud'@'localhost' IDENTIFIED BY 'w5C4AGeTzFY4Fz';
FLUSH PRIVILEGES;
QUIT

cd /var/www
wget https://download.nextcloud.com/server/releases/nextcloud-13.0.0.zip
unzip nextcloud-13.0.0.zip
mkdir /var/www/nextcloud/data
rm nextcloud-13.0.0.zip
# il est recommandé d’avoir un utilisateur dédié à la gestion du dossier nextcloud. Cet utilisateur aura des droits aussi restreints que possible à ce répertoire.
useradd nextcloud --comment "limited nextcloud user" --no-create-home
# modifier le propriétaire du répertoire /var/www/nextcloud et l’attribuer à un nouvel utilisateur dédié : nextcloud.
chown -R nextcloud:www-data /var/www/nextcloud
# retirer toutes les permissions de ce répertoire aux autre utilisateurs
chmod -R o-rwx /var/www/nextcloud

nano /etc/php/7.0/fpm/pool.d/nextcloud.conf

[nextcloud]

listen = /run/php/php7.0-fpm-nextcloud.sock

; Set permissions for unix socket, if one is used.
listen.owner = nextcloud
listen.group = www-data
listen.mode = 0660

; Unix user/group of processes.
user = nextcloud
group = www-data

pm = dynamic
pm.max_children = 6
pm.start_servers = 3
pm.min_spare_servers = 3
pm.max_spare_servers = 5
pm.max_requests = 500
pm.status_path = /fpm-status
ping.path = /ping
request_terminate_timeout = 1d
request_slowlog_timeout = 5s
slowlog = /var/log/nginx/nextcloud.slow.log
rlimit_files = 4096
rlimit_core = 0
chdir = /var/www/nextcloud/
catch_workers_output = yes
clear_env = no

php_value[upload_max_filesize] = 10G
php_value[post_max_size] = 10G
php_value[default_charset] = UTF-8

systemctl restart php7.0-fpm.service

nano /etc/nginx/conf.d/cinay.pw.d/nextcloud.conf

location ^~ /nextcloud {
  alias /var/www/nextcloud/;

  if ($scheme = http) {
    rewrite ^ https://$server_name$request_uri? permanent;
  }

    # Add headers to serve security related headers
    add_header                    X-Content-Type-Options nosniff;
    add_header                    X-XSS-Protection "1; mode=block";
    add_header                    X-Robots-Tag none;
    add_header                    X-Download-Options noopen;
    add_header                    X-Permitted-Cross-Domain-Policies none;
    add_header                    Strict-Transport-Security 'max-age=31536000; includeSubDomains;';

  # Set max upload size
  client_max_body_size 10G;
  fastcgi_buffers 64 4K;

  # Disable gzip to avoid the removal of the ETag header
  gzip off;

  # Errors pages
  error_page 403 /nextcloud/core/templates/403.php;
  error_page 404 /nextcloud/core/templates/404.php;

  # The following 2 rules are only needed for the user_webfinger app.
  # Uncomment it if you're planning to use this app.
  #rewrite ^/.well-known/host-meta /nextcloud/public.php?service=host-meta last;
  #rewrite ^/.well-known/host-meta.json /nextcloud/public.php?service=host-meta-json last;

  location /nextcloud {
    rewrite ^ /nextcloud/index.php$uri;
  }

  location = /nextcloud/robots.txt {
    allow all;
    log_not_found off;
    access_log off;
  }

  location ~ ^/nextcloud/(?:build|tests|config|lib|3rdparty|templates|data)/ {
    deny all;
  }
  location ~ ^/nextcloud/(?:\.|autotest|occ|issue|indie|db_|console) {
    deny all;
  }

  location ~ ^/nextcloud/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\.php(?:$|/) {
    include fastcgi_params;
    fastcgi_split_path_info ^(.+\.php)(/.+)$;
    fastcgi_param SCRIPT_FILENAME $request_filename;
    fastcgi_param PATH_INFO $fastcgi_path_info;
    fastcgi_param HTTPS on;
    fastcgi_param modHeadersAvailable true;
    fastcgi_param REMOTE_USER $remote_user;
    fastcgi_pass unix:/run/php/php7.0-fpm-nextcloud.sock;
    fastcgi_intercept_errors on;
  }

  location ~ ^/nextcloud/(?:updater|ocs-provider)(?:$|/) {
    try_files $uri/ =404;
    index index.php;
  }

  # Adding the cache control header for js and css files
  location ~* \.(?:css|js)$ {
    add_header Cache-Control "public, max-age=7200";
    # Add headers to serve security related headers
    add_header Strict-Transport-Security "max-age=15768000;";
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Robots-Tag none;
    add_header X-Download-Options noopen;
    add_header X-Permitted-Cross-Domain-Policies none;
    # Optional: Don't log access to assets
    access_log off;
  }

  location ~* \.(?:svg|gif|png|html|ttf|woff|ico|jpg|jpeg)$ {
    # Optional: Don't log access to other assets
    access_log off;
  }

}

nginx -t
	nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
	nginx: configuration file /etc/nginx/nginx.conf test is successful

systemctl restart php7.0-fpm nginx

server {
    listen 80;
    listen [::]:80;
    server_name nc.cinay.pw;
    # enforce https
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name nc.cinay.pw;

    include ssl_params;
    include header_params;
    include dh_param;

    add_header Strict-Transport-Security "max-age=31536000;";
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Robots-Tag none;
    add_header X-Download-Options noopen;
    add_header X-Permitted-Cross-Domain-Policies none;

    # Path to the root of your installation
    root /var/www/nextcloud/;

    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }

    # The following 2 rules are only needed for the user_webfinger app.
    # Uncomment it if you're planning to use this app.
    #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
    #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json
    # last;

    location = /.well-known/carddav {
      return 301 $scheme://$host/remote.php/dav;
    }
    location = /.well-known/caldav {
      return 301 $scheme://$host/remote.php/dav;
    }

    # set max upload size
    client_max_body_size 512M;
    fastcgi_buffers 64 4K;

    # Enable gzip but do not remove ETag headers
    gzip on;
    gzip_vary on;
    gzip_comp_level 4;
    gzip_min_length 256;
    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
    gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;

    # Uncomment if your server is build with the ngx_pagespeed module
    # This module is currently not supported.
    #pagespeed off;

    location / {
        rewrite ^ /index.php$uri;
    }

    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
        deny all;
    }
    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
        deny all;
    }

    location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) {
        fastcgi_split_path_info ^(.+\.php)(/.*)$;
        include fastcgi_params;
        #fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
         fastcgi_param SCRIPT_FILENAME $request_filename;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param HTTPS on;
        #Avoid sending the security headers twice
        fastcgi_param modHeadersAvailable true;
         fastcgi_param REMOTE_USER $remote_user;
        fastcgi_param front_controller_active true;
        fastcgi_pass php-handler;
        fastcgi_intercept_errors on;
        fastcgi_request_buffering off;
    }

    location ~ ^/(?:updater|ocs-provider)(?:$|/) {
        try_files $uri/ =404;
        index index.php;
    }

    # Adding the cache control header for js and css files
    # Make sure it is BELOW the PHP block
    location ~ \.(?:css|js|woff|svg|gif)$ {
        try_files $uri /index.php$uri$is_args$args;
        add_header Cache-Control "public, max-age=15778463";
        # Add headers to serve security related headers (It is intended to
        # have those duplicated to the ones above)
        # Before enabling Strict-Transport-Security headers please read into
        # this topic first.
        # add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
        #
        # WARNING: Only add the preload option once you read about
        # the consequences in https://hstspreload.org/. This option
        # will add the domain to a hardcoded list that is shipped
        # in all major browsers and getting removed from this list
        # could take several months.
        add_header X-Content-Type-Options nosniff;
        add_header X-XSS-Protection "1; mode=block";
        add_header X-Robots-Tag none;
        add_header X-Download-Options noopen;
        add_header X-Permitted-Cross-Domain-Policies none;
        # Optional: Don't log access to assets
        access_log off;
    }

    location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ {
        try_files $uri /index.php$uri$is_args$args;
        # Optional: Don't log access to other assets
        access_log off;
    }
}

nginx -t

systemctl restart php7.0-fpm nginx

  'trusted_domains' => 
  array (
    0 => 'nc.cinay.pw',
  ),
  'datadirectory' => '/var/www/nextcloud/data',
  'overwrite.cli.url' => 'https://nc.cinay.pw',

Avertissements de sécurité & configuration

Il est important pour la sécurité et la performance de votre instance que tout soit configuré correctement. Pour vous aider dans cette tâche, nous faisons des vérifications automatiques. Veuillez consulter la section Trucs et Astuces et la documentation pour plus d'informations.

x Tous les tests ont réussi.

sudo -
mkdir /mnt/local
# modifier le propriétaire du répertoire /var/www/nextcloud et l’attribuer à un nouvel utilisateur dédié : nextcloud.
chown -R nextcloud:www-data /var/www/nextcloud
# retirer toutes les permissions de ce répertoire aux autre utilisateurs
chmod -R o-rwx /var/www/nextcloud

cd /var/www/nextcloud/themes

git clone https://github.com/mwalbeck/nextcloud-breeze-dark.git

nano /var/www/nextcloud/config/config.php

  'theme' => 'nextcloud-breeze-dark',

export OVH_AK="MyBRE3Oq2FZrLC2N"
export OVH_AS="U8rSfBLK0OYNRoeaCZvatqxUcf5aE8bj"

/root/.acme.sh/acme.sh --dns dns_ovh --issue --keylength 4096 -d cinay.pw -d smtp.cinay.pw -d imap.cinay.pw -d webmail.cinay.pw -d mail.cinay.pw -d nc.cinay.pw -d gitlab.cinay.pw

curl -LJO https://packages.gitlab.com/gitlab/gitlab-ce/packages/debian/stretch/gitlab-ce_10.5.4-ce.0_amd64.deb/download
dpkg -i gitlab-ce_10.5.4-ce.0_amd64.deb

nano /etc/gitlab/gitlab.rb

external_url 'https://gitlab.cinay.pw'

nginx['enable'] = false
web_server['external_users'] = ['www-data']

sudo gitlab-ctl reconfigure     # Patienter quelques minutes !!!

Running handlers complete
Chef Client finished, 368/525 resources updated in 02 minutes 07 seconds
gitlab Reconfigured!

usermod -aG gitlab-www www-data

upstream gitlab-workhorse {
  server unix:/var/opt/gitlab/gitlab-workhorse/socket fail_timeout=0;
}

server {
    listen 80;
    listen [::]:80;
    server_name gitlab.cinay.pw;
    # enforce https
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name gitlab.cinay.pw;

    include ssl_params;
    include header_params;
    include dh_param;

  location / {
    client_max_body_size 0;
    gzip off;

    ## https://github.com/gitlabhq/gitlabhq/issues/694
    ## Some requests take more than 30 seconds.
    proxy_read_timeout      300;
    proxy_connect_timeout   300;
    proxy_redirect          off;

    proxy_http_version 1.1;

    proxy_set_header    Host                $http_host;
    proxy_set_header    X-Real-IP           $remote_addr;
    proxy_set_header    X-Forwarded-Ssl     on;
    proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
    proxy_set_header    X-Forwarded-Proto   $scheme;
    proxy_pass http://gitlab-workhorse;
  }
}

sudo nginx -t

systemctl reload nginx

sudo apt install git #debian
sudo pacman -S git   #archlinux/manjaro

git config --global user.name "Cin Yan"
git config --global user.email "yan@cinay.pw"

[credential]
	helper = store
[core]
	editor = nano