Koozali.org: home of the SME Server
  1. Koozali.org: home of the SME Server
  2. Obsolete Releases
  3. SME Server 9.x
  4. Topic: Letsencrypt with open ports 80 and 443 - how to harden the primary ibay
« previous next »
Pages: [1]   Go Down

Letsencrypt with open ports 80 and 443 - how to harden the primary ibay

  • 12 Replies
  • 2581 Views

Offline SchulzStefan

  • *
  • 620
  • +0/-0
Letsencrypt with open ports 80 and 443 - how to harden the primary ibay
« on: May 19, 2017, 11:54:53 AM »
As letsencrypt wants to have the ports 80 and 443 on the server opened I'm questioning myself, how can spiders, robots and all other crab being prevented from access?

I have in mind https://wiki.contribs.org/Htaccess#Using_a_.htaccess_file_to_configure_htaccess_requirements_-_not_recommended.

We do not use the server as a webserver, therefore I feel really uncomfortable to have a firewall opened for incoming connections on this ports landing on the SME.

Thanks for any hints.
stefan
Logged
And then one day you find ten years have got behind you.

Time, 1973
(Mason, Waters, Wright, Gilmour)

Offline Stefano

  • *
  • 10,839
  • +2/-0
Re: Letsencrypt with open ports 80 and 443 - how to harden the primary ibay
« Reply #1 on: May 19, 2017, 12:10:34 PM »
any web server is secure as long it is up-to-date on the daemon side (apache) and the exposed web pages are secure..

a static web page, an empty one, is likely not "hackable" at all and doesn't expose any kind of vulnerability

if you use the redirect (on your page or via .htaccess), almost no one can "touch" your server.

there are thousands of SME servers exposed to wan on ports 80 and 443 and the few times we knew about a compromised machine the fault was in a bugged webapp (CMS like wordpress and joomla)

IMVVVHO you'd lower a bit your "paranoic" POV.. don't get me wrong, but SME is a secure appliance, and following the above advices you have nothing to be worried about, really
Logged

Offline SchulzStefan

  • *
  • 620
  • +0/-0
Re: Letsencrypt with open ports 80 and 443 - how to harden the primary ibay
« Reply #2 on: May 19, 2017, 12:27:31 PM »
Stefano,

thanks for your reply.

Yes, I'm some kind of paranoid especially with data I want to keep personally.

Quote
if you use the redirect (on your page or via .htaccess), almost no one can "touch" your server.

I understood it's recommended not to use .htaccess with SME. Is that still true?

If I use a redirect in the index.htm like

<!DOCTYPE HTML>
<html>

<head>
  <meta http-equiv="refresh" content="1; URL=realdoamin-hosted-from-ISP">
</head>

will letsencrypt still work? I could imagine the requests will also be re-directed to the external domain.

regards,
stefan
Logged
And then one day you find ten years have got behind you.

Time, 1973
(Mason, Waters, Wright, Gilmour)

Offline Stefano

  • *
  • 10,839
  • +2/-0
Re: Letsencrypt with open ports 80 and 443 - how to harden the primary ibay
« Reply #3 on: May 19, 2017, 12:30:57 PM »
with such a redirection letsencrypt will work with no issues 'cause the procedure looks for a .well-known hidden subfolder
Logged

Offline SchulzStefan

  • *
  • 620
  • +0/-0
Re: Letsencrypt with open ports 80 and 443 - how to harden the primary ibay
« Reply #4 on: May 19, 2017, 12:37:41 PM »
Thank you, I'll give it a try and will report.

regards,
stefan
Logged
And then one day you find ten years have got behind you.

Time, 1973
(Mason, Waters, Wright, Gilmour)

Offline DanB35

  • ****
  • 764
  • +0/-0
    • http://www.familybrown.org
Re: Letsencrypt with open ports 80 and 443 - how to harden the primary ibay
« Reply #5 on: May 19, 2017, 12:53:42 PM »
Quote from: SchulzStefan on May 19, 2017, 11:54:53 AM
As letsencrypt wants to have the ports 80 and 443 on the server opened
Let's Encrypt requires that port 80 be open inbound, but not port 443.  It does require that both 80 and 443 are open outbound.
Logged
......

Offline SchulzStefan

  • *
  • 620
  • +0/-0
Re: Letsencrypt with open ports 80 and 443 - how to harden the primary ibay
« Reply #6 on: May 19, 2017, 01:33:23 PM »
Quote from: DanB35 on May 19, 2017, 12:53:42 PM
Let's Encrypt requires that port 80 be open inbound, but not port 443.  It does require that both 80 and 443 are open outbound.

Got this.

As I reported in the bugtracker I thought I found tonight a working solution. Without changing anything I tried to test BEFORE changing the html-redirect in the primary ibay, dehydrated -c.

This is the result:

# dehydrated -c
# INFO: Using main config file /etc/dehydrated/config
  + ERROR: An error occurred while sending get-request to https://acme-v01.api.letsencrypt.org/directory (Status 504)

Details:
<HTML><HEAD><TITLE>Error</TITLE></HEAD><BODY>
An error occurred while processing your request.<p>
Reference&#xxx
</BODY></HTML>

I don't understand it. Do they allow only one request per day as I created the daily cron job for the request? That worked in the night which I saw in the logs. I read the servers are sometimes not reachable. Should I just wait a few days and keep an eye on this? I mean calling this URL in a browser ends also in a timeout.

regards,
stefan
« Last Edit: May 19, 2017, 02:28:08 PM by SchulzStefan »
Logged
And then one day you find ten years have got behind you.

Time, 1973
(Mason, Waters, Wright, Gilmour)

Offline DanB35

  • ****
  • 764
  • +0/-0
    • http://www.familybrown.org
Re: Letsencrypt with open ports 80 and 443 - how to harden the primary ibay
« Reply #7 on: May 19, 2017, 01:46:41 PM »
No, they're having a service disruption right now.  Lots of people are getting that result.  It should be back up shortly.
Logged
......

Offline SchulzStefan

  • *
  • 620
  • +0/-0
Re: Letsencrypt with open ports 80 and 443 - how to harden the primary ibay
« Reply #8 on: May 21, 2017, 11:54:28 AM »
DanB35,

you've been right, they're back.

As I followed the advice of Janet changing from *.local to a registered domain, and installing letsencrypt for one of my domains, there are coming up a few questions to me. Maybe someone could help me to understand better what's making sense now. Further I followed the advice from Stefano and added cnames for the new created subdomains (hosts are the same now in the SME) in the registered domain to point to my dyndns.

As I can see, letsencrypt created all certs, so fine so far.

BEFORE installing letsencrypt my primary domain ended *.local. It has been resolved locally. I changed this now to a real registered domain ending now in *.de. It is still resolved locally or must this be changed now?

BEFORE letsencrypt my email retrieval was set to secondary, means an external server of my ISP. Email was fetched all 5 minutes.

BEFORE letsencrypt the email delivery was set to my Internet provider's SMTP server.

The whole configuration worked fine since SME 5.x :)

Working now with letsencrypt certs, should I change the email retrieval and delivery? In case of changing would I have to change the mx from my ISP mailserver to the SME? What would be the advantages/disadvantages? I don't get this clearly sorted out, sorry.

Thank's for any help.
stefan
« Last Edit: May 21, 2017, 12:08:58 PM by SchulzStefan »
Logged
And then one day you find ten years have got behind you.

Time, 1973
(Mason, Waters, Wright, Gilmour)

Offline janet

  • ****
  • 4,812
  • +0/-0
Re: Letsencrypt with open ports 80 and 443 - how to harden the primary ibay
« Reply #9 on: May 21, 2017, 03:49:10 PM »
SchulzStefan

I will answer one.

Quote
BEFORE installing letsencrypt my primary domain ended *.local. It has been resolved locally. I changed this now to a real registered domain ending now in *.de. It is still resolved locally or must this be changed now?

The resolve locally setting has nothing to do with external access to your site.
This only affects local users who will resolve their requests directly to your server without querying external DNS servers.
You might want local users to directly access the local site/domain for some reason or other, or to even access a different site (hosted locally) than what external users would access). Many possible reasons for this.

DNS for your domain is handled externally by whoever manages your domains, & external user access is directed to your server by them.

It probably does not matter whether you have resolve locally or resolve to external DNS servers set.
Logged
Please search before asking, an answer may already exist.
The Search & other links to useful information are at top of Forum.

Offline SchulzStefan

  • *
  • 620
  • +0/-0
Re: Letsencrypt with open ports 80 and 443 - how to harden the primary ibay
« Reply #10 on: May 22, 2017, 01:28:58 PM »
Janet,

thank you fro your reply.

Has anybody some hints/suggestions to my other question in relation with letsencrypt certs and email?

Quote
Working now with letsencrypt certs, should I change the email retrieval and delivery? In case of changing would I have to change the mx from my ISP mailserver to the SME? What would be the advantages/disadvantages? I don't get this clearly sorted out, sorry.

Would be nice to get a feedback.
stefan

edit for test result:

Did a test, here's the result of sending an email while disabling email delivery to ISP:

Hi. This is the qmail-send program at xxx.de.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

<stefan.schulz@xyz.de>:
Connected to 213.00.000.000 but sender was rejected.
Remote host said: 550 5.1.0 Dynamic/Generic hostnames are blocked. Please contact your Email Provider. Your IP was 84.000.000.000. Your hostname was p57.dip0.t-ipconnect.de

That means to me this will work only with a fix IP, is that right?
« Last Edit: May 22, 2017, 01:46:50 PM by SchulzStefan »
Logged
And then one day you find ten years have got behind you.

Time, 1973
(Mason, Waters, Wright, Gilmour)

Offline janet

  • ****
  • 4,812
  • +0/-0
Re: Letsencrypt with open ports 80 and 443 - how to harden the primary ibay
« Reply #11 on: June 14, 2017, 11:38:11 PM »
SchulzStefan

If your Internet connection for sme server uses a dynamic IP then your sme server is not likely to be trusted by other mail servers/recipient systems.
You will need to send mail via your ISPs smtp server.
Only your ISP trusts your dynamic IP as you are physically connected directly to the ISP.

This appears to be what you used to do.
Logged
Please search before asking, an answer may already exist.
The Search & other links to useful information are at top of Forum.

Offline CharlieBrady

  • *
  • 6,918
  • +3/-0
Re: Letsencrypt with open ports 80 and 443 - how to harden the primary ibay
« Reply #12 on: June 15, 2017, 05:12:14 PM »
Quote from: SchulzStefan on May 19, 2017, 11:54:53 AM
As letsencrypt wants to have the ports 80 and 443 on the server opened I'm questioning myself, how can spiders, robots and all other crab being prevented from access?

To control well-behaved robots, create a robots.txt file. Non-well controlled robots can't be controlled; just don't put anything in the primary ibay (or any visible ibay) which you don't want them to be able to fetch. You don't need any other hardening.

You are correct about .htaccess - not recommended and not required.
Logged
Pages: [1]   Go Up
« previous next »
  1. Koozali.org: home of the SME Server
  2. Obsolete Releases
  3. SME Server 9.x
  4. Topic: Letsencrypt with open ports 80 and 443 - how to harden the primary ibay