This tutorial describes the steps to renew the SSL Certificate of the ISPConfig 3 control panel. There are two alternative ways to achieve that:
- Create a new OpenSSL Certificate and CSR on the command line with OpenSSL.
- Renew the SSL Certificate with the ISPConfig updater
I'll start with the manual way to renew the ssl cert.
1) Create a new ISPConfig 3 SSL Certificate with OpenSSL
Login to your server on the shell as root user. Before we create a new SSL Cert, backup the current ones. SSL Certs are security sensitive so I'll store the backup in the /root/ folder.
tar pcfz /root/ispconfig_ssl_backup.tar.gz /usr/local/ispconfig/interface/ssl
chmod 600 /root/ispconfig_ssl_backup.tar.gz
Now create a new SSL Certificate key, Certificate Request (csr) and a self signed Certificate.
openssl genrsa -des3 -out ispserver.key 4096
openssl req -new -key ispserver.key -out ispserver.csr
openssl x509 -req -days 3650 -in ispserver.csr \
-signkey ispserver.key -out ispserver.crt
openssl rsa -in ispserver.key -out ispserver.key.insecure
mv ispserver.key ispserver.key.secure
mv ispserver.key.insecure ispserver.key
Restart Apache to load the new SSL Certificate.
service apache2 restart
2) Renew the SSL Certificate with the ISPConfig installer
The alternative way to get a new SSL Certificate is to use the ISPConfig update script.
Download ISPConfig to the /tmp folder, unpack the archive and start the update script.
tar xvfz ISPConfig-3-stable.tar.gz
php -q update.php
The update script will ask the following question during update:
Create new ISPConfig SSL certificate (yes,no) [no]:
Answer "yes" here and the SSL Certificate creation dialog will start.
High page speed and short page load times of your website are essential for good search engine rankings today. In this FAQ, I will show you how to enable caching of graphic and CSS files in apache on Ubuntu and Debian.
The first step is to enable the expires module in apache:
a2enmod headers expires
This module allows the apache web server to set HTTP headers, in this case, to set the modification header for static assets like image and CSS files that don't change often.
Add the following config snippet inside the vhost file of the web site or at the end of the file /etc/apache2/apache2.conf to enable it globally.
Header set Cache-Control "max-age=3024000, public"
Finally reload apache to apply the configuration change.
service apache2 reload
On ISPConfig 3 servers, the snippet can be added in the "Apache Directives" field of the website instead. There is no apache reload required as ISPConfig takes care about that.
Jailkit is an easy to use tool to create and maintain jail environments for shell users on Linux. In this guide, I will show you how to move PHP and its dependencies into the jail so that the jailed user can execute PHP scripts inside the jail.
Continue reading How to add PHP support for jailed SSH users in ISPConfig 3
Here is a list of ports that are used commonly on ISPConfig 3 servers. If you don't have all services installed or if you e.g. don't want to connect to MySQL from external servers, then close the unused or unwanted ports.
20 - FTP Data
21 - FTP Command
22 - SSH
25 - Email
53 - DNS
80 - HTTP (Webserver)
110 - POP3 (Email)
143 -Imap (Email)
443 - HTTPS (Secure web server)
993 - IMAPS (Secure Imap)
995 - POP3S (Secure POP3)
3306 - MySQL Database server
8080 - ISPConfig web interface
8081- ISPConfig apps vhost
53 - DNS
3306 - MySQL
To disable the error.log for a website in ISPConfig on an Apache web server, follow this steps:
1) Login to ISPConfig
2) Go to the website settings of the website where you like to disable the error.log and there go to the "Options tab"
3) Add the following line in the field labeled "Apache Directives"
and press save:
If your mail server stops working (neither incoming nor outgoing email works) and you find the following error message in the mail.log file:
fatal: open database /var/lib/postfix/smtpd_scache.db: File exists
then the smtpd_scache.db might got corrupted. Postfix will recreate this file if it does not exist. So it can be removed to solve the issue:
rm -f /var/lib/postfix/smtpd_scache.db
Thanks to Alexander Fox for sending me this FAQ.
Dovecot is watching the whole server filesystem for modifications and removed or added sub filesystems. If you get errors similar to this one on your server:
Aug 30 09:10:23 server1 dovecot: master: Warning: /var/www/clients/client1/web1/log is no longer mounted. If this is intentional, remove it with doveadm mount
(the directory path may vary), then you can fix it by excluding the path from being watched by dovecot. In my case, dovecot shall not watch my website directories as they do not contain any mailboxes
Run the following command on the shell as root user:
doveadm mount add '/var/www/*' ignore
To exclude all files and folders in /var/www from deovecot monitoring.
If you get error messages from amavisd similar to the one posted below on a server which is virtualized with OpenVZ:
Mar 5 09:09:02 v100 amavis: (17378-14) (!!)TROUBLE in process_request: Error writing a SMTP response to the socket: Broken pipe at (eval 100) line 987, <GEN44> line 31.
then the issue can be caused by the NUMTCPSOCK value in the openvz limits. Even if the barrier of this limit was never met in /proc/user_beancounters, the above error occurs when more then 25% of all TCP sockets were used. The solution is to set the NUMTCPSOCK barrier and limit to a high value in the openvz container configuration file. Here a value that worked for me on a moderately used mailserver:
Finally restart the OpenVZ VM to apply the new limit value.
If you use the apache mod_security module on your apache server, you might encounter wrong 403 errors for several URL's of the cms systems. Here are some exception rules to avoid that:
For WordPress Blogs
For the ModX CMS
SecRuleRemoveById 300013 300014 300015 300016
SecRuleRemoveById 300013 300016
Add these rules inside the vhost file of the website. If you use ISPConfig to manage the server, then add the rules in the apache directives field of the website settings in ispconfig.
Many thanks to PlanetFox for providing the rules.
The following guide shows how to disable and remove mysql replication from two or more mysql servers. These steps can be used for master/slave and master/master mysql setups. The following SQL commands have to be be executed in phpmyadmin or with the mysql commandline program. It is just important that you are logged in as mysql root user. Below I will use the mysql commandline client.
Login into mysql as root user from commandline:
mysql -u root -p
the mysql command will ask for the mysql root password.
Then execute these commands if the installed mysql version is < 5.5.16:
use the commands below instead if the mysql version is > 5.5.16
RESET SLAVE ALL;
Now edit the my.cnf file (/etc/mysql/my.cnf) and add a # in front of all lines that start with "replicate-" or "master-". Example:
# replicate-same-server-id = 0
# master-host = 192.168.0.105
# master-user = slaveuser
# master-password = akst6Wqcz2B
# master-connect-retry = 60
Then restart mysql: