how to downgrade to 3.03

georges · Jan 31, 2012

Restarting IMAP/POP3 mail server: dovecot.
[Tue Jan 31 11:36:18 2012] [warn] _default_ VirtualHost overlap on port 443, the first has precedence
[Tue Jan 31 11:36:18 2012] [warn] NameVirtualHost xxxxx:80 has no VirtualHosts
[Tue Jan 31 11:36:18 2012] [warn] NameVirtualHost xxxxxxxxx:443 has no VirtualHosts
[Tue Jan 31 11:36:19 2012] [warn] _default_ VirtualHost overlap on port 443, the first has precedence
[Tue Jan 31 11:36:19 2012] [warn] NameVirtualHost xxxxxx:80 has no VirtualHosts
[Tue Jan 31 11:36:19 2012] [warn] NameVirtualHost xxxxx:443 has no VirtualHosts
Restarting web server: apache2 ... waiting .
Restarting ftp server: Running: /usr/sbin/pure-ftpd-mysql-virtualchroot -l mysql:/etc/pure-ftpd/db/mysql.conf -l pam -D -E -b -A -Y 1 -O clf:/var/log/pure-ftpd /transfer.log -8 UTF-8 -H -u 1000 -B
Click to expand...

If you look at the other post, you see the whole range of files was there.
In addition:
1) it seems to me, more we try to repair, more we lost a different file
2) In this case, I didn't add

## must be re-added after an ISPConfig update!!!
SSLCertificateChainFile /usr/local/ispconfig/interface/ssl/startssl.sub.class1.server.ca.crt
Click to expand...

because you didn't ask for that.

So we wait for tomorrow or later to see what shows the apache log.
At this time, there is always a problem wirth the blank page and opera. I will check other site and other browser.
I'm a little skeptical because different people try and failed.

Anyway, I thank you to take time to help me.

till · Jan 31, 2012

If you look at the other post, you see the whole range of files was there.
Click to expand...

I said that the file was missing or corrupt. If a single bit in a ssl cert is not ok, then apache will fail.

1) it seems to me, more we try to repair, more we lost a different file
2) In this case, I didn't add
Click to expand...

This file is required for startssl only, it is not required for a self signed ssl cert as it is normally used by ispconfig and as you recreated now. So this line is not missing currently and needs only be added if you install a startssl certificate again.

georges · Jan 31, 2012

It doesn't change anything:

[Tue Jan 31 11:36:18 2012] [notice] caught SIGTERM, shutting down
[Tue Jan 31 11:36:19 2012] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Tue Jan 31 11:36:19 2012] [warn] RSA server certificate CommonName (CN) `xxxxx' does NOT match server name!?
[Tue Jan 31 11:36:19 2012] [warn] Init: (nsxxxxx.ovh.net:443) You configured HTTP(80) on the standard HTTPS(443) port!
[Tue Jan 31 11:36:19 2012] [warn] Init: (nsxxxx.ovh.net:443) You configured HTTP(80) on the standard HTTPS(443) port!
[Tue Jan 31 11:36:19 2012] [notice] suEXEC mechanism enabled (wrapper: /usr/lib/apache2/suexec)
[Tue Jan 31 11:36:19 2012] [notice] Digest: generating secret for digest authentication ...
[Tue Jan 31 11:36:19 2012] [notice] Digest: done
[Tue Jan 31 11:36:19 2012] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Tue Jan 31 11:36:19 2012] [warn] RSA server certificate CommonName (CN) `xxxxxxx' does NOT match server name!?
[Tue Jan 31 11:36:19 2012] [warn] Init: (nsxxxx.ovh.net:443) You configured HTTP(80) on the standard HTTPS(443) port!
[Tue Jan 31 11:36:19 2012] [warn] Init: (nsxxxx.ovh.net:443) You configured HTTP(80) on the standard HTTPS(443) port!
[Tue Jan 31 11:36:19 2012] [notice] Apache/2.2.16 (Debian) DAV/2 mod_fcgid/2.3.6 PHP/5.3.3-7+squeeze3 with Suhosin-Patch mod_ruby/1.2.6 Ruby/1.8.7(2010-08-16) mod_ssl/2.2.16 OpenSSL/0.9.8o configured -- resuming norm$
[Tue Jan 31 13:13:02 2012] [error] [client yyyy] Invalid method in request \x16\x03\x01
[Tue Jan 31 14:19:20 2012] [error] [client xxxx] File does not exist: /var/www/CFIDE
[Tue Jan 31 15:44:21 2012] [error] [client xxxxx] request failed: error reading the headers, referer: http://vvvvvvvvvvvvvvvvvvvv
[Tue Jan 31 17:09:27 2012] [error] [client 66.249.71.112] Invalid method in request \x16\x03\x01
[Tue Jan 31 17:09:27 2012] [error] [client 66.249.71.112] Invalid method in request \x80F\x01\x03\x01
[Tue Jan 31 17:12:32 2012] [error] [client ccccccc] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): /w00tw00t.at.ISC.SANS.DFind:
Click to expand...

till · Jan 31, 2012

Thats a diferent port (443 and not 8080, so its a different different vhost) then the one you posted here in the thread.

According to the error, there is a second vhost configured to run http on https port, maybe you or your collegue removed some more ssl lines from config files while you tried to repair the issue? If you remember which apache files you edited, then you should check these files first. It might be e.g. the debian default-ssl vhost.

georges · Jan 31, 2012

According to the error, there is a second vhost configured to run http on https port, maybe you or your collegue removed some more ssl lines from config files while you tried to repair the issue? If you remember which apache files you edited, then you should check these files first. It might be e.g. the debian default-ssl vhost.
Click to expand...

Ok, we compare the different files with those of another server

thkx

fxs · Feb 2, 2012

According to the error, there is a second vhost configured to run http on https port, maybe you or your collegue removed some more ssl lines from config files while you tried to repair the issue? If you remember which apache files you edited, then you should check these files first. It might be e.g. the debian default-ssl vhost. ]
Click to expand...

You are right. Some # has been left in default-ssl vhost.
Then everything works well.
So I have the bad idea to continue the ssl-tuto and I've introduced another issue that I am unable to solve altthoug many working hours

root@nsxxxx:/etc/ssl/private# mv pure-ftpd.pem pure-ftpd.pem_bak
root@nsxxxx:/etc/ssl/private# ln -s /usr/local/ispconfig/interface/ssl/ispserver.pem pure-ftpd.pem
root@nsxxxx:/etc/ssl/private# /etc/init.d/pure-ftpd-mysql restart
Restarting ftp server: Running: /usr/sbin/pure-ftpd-mysql-virtualchroot -l mysql :/etc/pure-ftpd/db/mysql.conf -l pam -D -E -b -A -Y 1 -O clf:/var/log/pure-ftpd/ transfer.log -8 UTF-8 -H -u 1000 -B
root@nsxxxx:/etc/ssl/private# cd
root@nsxxxx:~# /etc/init.d/apache2 restart
Restarting web server: apache2(98)Address already in use: make_sock: could not b ind to address [::]:80
(98)Address already in use: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down
Unable to open logs
Action 'start' failed.
Click to expand...

and

netstat -tulpn | grep :80
tcp6 0 0 :::8080 :::* LISTEN 12977/apache2
tcp6 0 0 :::80 :::* LISTEN 12977/apache2
tcp6 0 0 :::8081 :::* LISTEN 12977/apache2
Click to expand...

we killall apache2 and /etc/init.d/apache2 restart
But we ran another problem: nobody can any more use FTP-Server: ISpconfig: offline
But we ran another problem: nobody can any more use FTP-Server.
ISpconfig: offline
For what we are doing we are happy with ISPCONFIG3. Thank you for this great product.
But we have some problem with SSL (or the opposite). What is the best way to remove safely SSLlink for postfix, dovecot, and pure-ftp.
How to restart safel ftp-server
Thanks for your inputs

we give you some additional info below

fxs · Feb 2, 2012

netstat –tap

Connexions Internet actives (serveurs et établies)
Proto Recv-Q Send-Q Adresse locale Adresse distante Etat PID/Program name
tcp 0 0 localhost.localdo:10024 *:* LISTEN 23904/amavisd (mast
tcp 0 0 localhost.localdo:10025 *:* LISTEN 23722/master
tcp 0 0 *:mysql *:* LISTEN 23539/mysqld
tcp 0 0 *op3 *:* LISTEN 21816/pop3-login
tcp 0 0 *:imap2 *:* LISTEN 20925/imap-login
tcp 0 0 nxxxxx.ovh.net:www 193.205.233.25:29972 SYN_RECV -
tcp 0 0 nsxxxxx.ovh.net:www ARennes-359-1-257:50200 SYN_RECV -
tcp 0 0 nsxxxxx.ovh.net:domain *:* LISTEN 24891/named
tcp 0 0 localhost.locald:domain *:* LISTEN 24891/named
tcp 0 0 *:munin *:* LISTEN 6614/munin-node
tcp 0 0 *:ssh *:* LISTEN 16221/sshd
tcp 0 0 localhost.localdoma:953 *:* LISTEN 24891/named
tcp 0 0 *:smtp *:* LISTEN 23722/master
tcp 0 0 *:imaps *:* LISTEN 20925/imap-login
tcp 0 0 *op3s *:* LISTEN 21816/pop3-login
tcp 0 0 localhost.localdo:44761 localhost.localdo:mysql ESTABLISHED 24808/amavisd (ch4-
tcp 0 52 nsxxxxx.ovh.net:ssh 68-4.62-188.cust.:33726 ESTABLISHED 27820/0
tcp 0 0 localhost.localdo:mysql localhost.localdo:44761 ESTABLISHED 23539/mysqld
tcp 1 0 localhost.localdo:44771 localhost.localdo:mysql CLOSE_WAIT 24809/amavisd (ch4-
tcp6 0 0 [::]:http-alt [::]:* LISTEN 26863/apache2
tcp6 0 0 [::]:www [::]:* LISTEN 26863/apache2
tcp6 0 0 [::]:tproxy [::]:* LISTEN 26863/apache2
tcp6 0 0 [::]:domain [::]:* LISTEN 24891/named
tcp6 0 0 [::]:ssh [::]:* LISTEN 16221/sshd
tcp6 0 0 ip6-localhost:953 [::]:* LISTEN 24891/named
tcp6 0 0 [::]:https [::]:* LISTEN 26863/apache2
Click to expand...

and

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain fail2ban-apache (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere

Chain fail2ban-apache-noscript (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere

Chain fail2ban-apache-overflows (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere

Chain fail2ban-courierauth (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere

Chain fail2ban-couriersmtp (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere

Chain fail2ban-dovecot-pop3imap (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere

Chain fail2ban-fail2ban (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere

Chain fail2ban-pam-generic (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere

Chain fail2ban-postfix (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere

Chain fail2ban-proftpd (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere

Chain fail2ban-pureftpd (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere

Chain fail2ban-roundcube (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere

Chain fail2ban-sasl (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere

Chain fail2ban-ssh (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere

Chain fail2ban-ssh-ddos (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere

Chain fail2ban-vsftpd (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere

Chain fail2ban-wuftpd (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere

Chain fail2ban-xinetd-fail (0 references)
target prot opt source destination
RETURN all -- anywhere anywhere

Chain fail2ban-xinetd-fail-log (0 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 6/min burst 2 LOG level warning prefix `fail2ban-xinetd-failROP '
DROP all -- anywhere anywhere
Click to expand...

Thank you for your time

Log in or Sign up

how to downgrade to 3.03

georges New Member

till Super Moderator Staff Member ISPConfig Developer

georges New Member

till Super Moderator Staff Member ISPConfig Developer

georges New Member

fxs New Member

fxs New Member

Share This Page

Log in or Sign up

how to downgrade to 3.03

georges New Member

till Super Moderator Staff Member ISPConfig Developer

georges New Member

till Super Moderator Staff Member ISPConfig Developer

georges New Member

fxs New Member

fxs New Member

Share This Page

Useful Searches